ips attack event
EventID=3011256137575066658 IncidentID=3011256354125025046 Tagkey=10.11.4.26:50226:10.11.4.27:25:3000982640374151870-66b6bb70-a213-11ed-af92-52201c5a5c62 DecoyGroup=IT_Decoy DecoyType=Windows10 AttackerIP=10.11.4.26 AttackerPort=50226 VictimIP=10.11.4.27 VictimPort=25 Operation=SMTP_Disconnect Service=SMTP Username=NA Password=NA Description="disconnect"
EventID=3011251782973974539 IncidentID=3011251971142112465 Tagkey=10.11.4.26:38658:10.11.4.27:3389:3000982640374151870-cedbe696-a212-11ed-a422-52201c5a5c62 DecoyGroup=IT_Decoy DecoyType=Windows10 AttackerIP=10.11.4.26 AttackerPort=38658 VictimIP=10.11.4.27 VictimPort=3389 Operation=IPS_attack Attack=tools: Nmap.Script.Scanner (#1 in pkt 5754) Description="tools: Nmap.Script.Scanner (#1 in pkt 5754)"
| Log Field Name | Description | Data Type |
|---|---|---|
|
Attack |
Attack name This field may not appear in every log. |
string |
|
AttackerIP |
Event source ip |
string |
|
AttackerPort |
Event source port |
int |
|
DecoyGroup |
Decoy group name |
string |
|
DecoyType |
Decoy OS type |
string |
|
Description |
Extra detail |
string |
|
eventID |
Event id |
int |
|
incidentID |
Incident id |
int |
|
Operation |
Event operation |
string |
|
Password |
Password used to attack the decoy This field may not appear in every log. |
string |
|
Service |
Event service, for example, samba, ssh This field may not appear in every log. |
string |
|
Tagkey |
Key used to group events into incident |
string |
|
Username |
The username used to attack decoy This field may not appear in every log. |
string |
|
VictimIP |
Event destination ip |
string |
|
VictimPort |
Event destination port |
int |