Regular event
EventID=2999850772968973605 IncidentID=2999783180299782560 Tagkey=10.11.4.24:27149:10.11.4.21:445:2999677334472857190-066b950c-9c93-11ed-ba4f-52d7cbdbef3e DecoyGroup=IT_Decoy DecoyType=Windows11 AttackerIP=10.11.4.24 AttackerPort=27149 VictimIP=10.11.4.21 VictimPort=445 Operation=Logoff_via_net_share Service=SMB Username=NA Password=NA Description="User karl SMB Logoff"
| Log Field Name | Description | Data Type |
|---|---|---|
|
AttackerIP |
Event source ip |
string |
|
AttackerPort |
Event source port |
int |
|
DecoyGroup |
Decoy group name |
string |
|
DecoyType |
Decoy OS type |
string |
|
Description |
Extra information for event, for example, ssh command, file changes, etc |
string |
|
EventID |
Event id |
int |
|
IncidentID |
Incident id |
int |
|
Operation |
Event operation |
string |
|
Password |
Password used to attack the decoy |
string |
|
Service |
Event service, for example, samba, ssh |
string |
|
Tagkey |
Key used to group events into incident |
string |
|
Username |
The username used to attack decoy |
string |
|
VictimIP |
Event destination ip |
string |
|
VictimPort |
Event destination port |
int |