{
  "_index": "logstash-host_id-2023.10.03",
  "_type": "_doc",
  "_id": "SSProbe-1_172.18.127.129_0",
  "_version": 1,
  "_score": 1,
  "_source": {
    "host_id": {
      "last_seen": "2023-10-04T00:05:03.406312+0200",
      "tls.ja3": [
        {
          "last_seen": "2023-10-04T00:05:03.795127+0200",
          "string": "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0",
          "first_seen": "2023-04-27T18:36:21.731724+0200",
          "agent": [
            "Zalando/4.66.0 (Linux; Android 5.1.1; Samsung SM-N950N/greatlteks-user 5.1.1 NMF26X 500200226 release-keys)"
          ],
          "hash": "3b5074b1b5d032e5620f69f9f700ff0e"
        },
        {
          "last_seen": "2023-10-04T00:05:03.414008+0200",
          "string": "771,4865-4866-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0",
          "first_seen": "2023-04-27T18:36:21.701137+0200",
          "hash": "24c42d3e77f06f2a8f47f4ebbbfdfaf4"
        },
        {
          "last_seen": "2023-10-04T00:05:03.916224+0200",
          "string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0",
          "first_seen": "2023-04-27T18:36:21.917608+0200",
          "agent": [
            "Mozills37.36"
          ],
          "hash": "28a2c9bd18a11de089ef85a160da29e4"
        },
        {
          "last_seen": "2023-10-04T00:05:04.562889+0200",
          "string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0",
          "first_seen": "2023-04-27T18:36:22.811725+0200",
          "agent": [
            "XYZ Spider"
          ],
          "hash": "a0e9f5d64349fb13191bc781f81f42e1"
        },
        {
          "last_seen": "2023-08-24T00:19:45.957862+0200",
          "string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0",
          "first_seen": "2023-04-27T18:36:27.245843+0200",
          "agent": [
            "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; .NET CLR 4.1.70608;  MASEJS; rv:11.0) like Gecko"
          ],
          "hash": "6271f898ce5be7dd52b0fc260d0662b3"
        },
        {
          "last_seen": "2023-08-24T00:19:48.486099+0200",
          "string": "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0",
          "first_seen": "2023-04-27T18:36:28.092902+0200",
          "agent": [
            "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko"
          ],
          "hash": "37f463bf4616ecd445d4a1937da06e19"
        }
      ],
      "hostname": [
        {
          "host": "desktop-ufnm04v",
          "last_seen": "2023-10-04T00:05:05.322898+0200",
          "first_seen": "2023-04-27T18:36:23.722312+0200"
        }
      ],
      "username": [
        {
          "last_seen": "2023-08-24T00:19:48.359041+0200",
          "first_seen": "2023-04-27T18:36:29.763489+0200",
          "user": "dmorgenstern@tangerinebox.tech"
        }
      ],
      "net_info": [
        {
          "last_seen": "2023-08-24T00:26:01.177906+0200",
          "agg": "user.gcxga.org.affected-users",
          "first_seen": "2023-08-24T00:19:44.130012+0200"
        }
      ],
      "first_seen": "2023-04-27T18:36:22.274080+0200",
      "client_service": [
        {
          "name": "http",
          "last_seen": "2023-08-24T00:19:52.184681+0200",
          "first_seen": "2023-04-27T18:36:25.508454+0200"
        },
        {
          "name": "tls",
          "last_seen": "2023-10-04T00:05:06.670197+0200",
          "first_seen": "2023-04-27T18:36:27.527913+0200"
        },
        {
          "name": "dcerpc",
          "last_seen": "2023-08-24T00:19:51.507827+0200",
          "first_seen": "2023-04-27T18:36:31.552813+0200"
        },
        {
          "name": "smb",
          "last_seen": "2023-08-24T00:19:49.507431+0200",
          "first_seen": "2023-04-27T18:36:34.249769+0200"
        },
        {
          "name": "krb5",
          "last_seen": "2023-08-24T00:19:51.507525+0200",
          "first_seen": "2023-04-27T18:36:38.276863+0200"
        }
      ],
      "http.user_agent": [
        {
          "last_seen": "2023-08-24T00:19:46.700214+0200",
          "first_seen": "2023-04-27T18:36:27.129372+0200",
          "agent": "Microsoft-CryptoAPI/10.0"
        }
      ]
    },
    "host": "SSProbe-1",
    "see_name": "stamus-central-server",
    "agent": {
      "ephemeral_id": "6bc88545-186c-47b6-8fd4-1b865c59f0e1",
      "hostname": "SSProbe-1",
      "id": "9f305fa4-6db1-485c-81f9-598dce1469e3",
      "type": "filebeat",
      "name": "SSProbe-1",
      "version": "7.17.10"
    },
    "type": "json-log",
    "log": {
      "file": {
        "path": "/var/log/suricata/eve-host_id-0.json"
      },
      "offset": 77542198
    },
    "logger": "logstash-manager",
    "worker": 0,
    "event_type": "host_id",
    "@version": "1",
    "input": {
      "type": "log"
    },
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "see_id": "2e2cf4a77cbd",
    "@timestamp": "2023-10-03T22:05:08.439Z",
    "ip": "172.18.127.129"
  },
  "fields": {
    "agent.version.keyword": [
      "7.17.10"
    ],
    "host_id.tls.ja3.hash.keyword": [
      "3b5074b1b5d032e5620f69f9f700ff0e",
      "24c42d3e77f06f2a8f47f4ebbbfdfaf4",
      "28a2c9bd18a11de089ef85a160da29e4",
      "a0e9f5d64349fb13191bc781f81f42e1",
      "6271f898ce5be7dd52b0fc260d0662b3",
      "37f463bf4616ecd445d4a1937da06e19"
    ],
    "host_id.client_service.last_seen": [
      "2023-08-23T22:19:52.184Z",
      "2023-10-03T22:05:06.670Z",
      "2023-08-23T22:19:51.507Z",
      "2023-08-23T22:19:49.507Z",
      "2023-08-23T22:19:51.507Z"
    ],
    "host_id.net_info.agg.keyword": [
      "user.gcxga.org.affected-users"
    ],
    "logger": [
      "logstash-manager"
    ],
    "host_id.client_service.first_seen": [
      "2023-04-27T16:36:25.508Z",
      "2023-04-27T16:36:27.527Z",
      "2023-04-27T16:36:31.552Z",
      "2023-04-27T16:36:34.249Z",
      "2023-04-27T16:36:38.276Z"
    ],
    "host_id.tls.ja3.string.keyword": [
      "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0",
      "771,4865-4866-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0"
    ],
    "type": [
      "json-log"
    ],
    "agent.hostname.keyword": [
      "SSProbe-1"
    ],
    "see_id.keyword": [
      "2e2cf4a77cbd"
    ],
    "host_id.username.last_seen": [
      "2023-08-23T22:19:48.359Z"
    ],
    "event_type": [
      "host_id"
    ],
    "host_id.tls.ja3.agent.keyword": [
      "Zalando/4.66.0 (Linux; Android 5.1.1; Samsung SM-N950N/greatlteks-user 5.1.1 NMF26X 500200226 release-keys)",
      "Mozills37.36",
      "XYZ Spider",
      "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; .NET CLR 4.1.70608;  MASEJS; rv:11.0) like Gecko",
      "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "type.keyword": [
      "json-log"
    ],
    "see_name.keyword": [
      "stamus-central-server"
    ],
    "host": [
      "SSProbe-1"
    ],
    "host_id.tls.ja3.first_seen": [
      "2023-04-27T16:36:21.731Z",
      "2023-04-27T16:36:21.701Z",
      "2023-04-27T16:36:21.917Z",
      "2023-04-27T16:36:22.811Z",
      "2023-04-27T16:36:27.245Z",
      "2023-04-27T16:36:28.092Z"
    ],
    "agent.name": [
      "SSProbe-1"
    ],
    "worker": [
      0
    ],
    "host.keyword": [
      "SSProbe-1"
    ],
    "agent.version.raw": [
      "7.17.10"
    ],
    "host_id.hostname.last_seen": [
      "2023-10-03T22:05:05.322Z"
    ],
    "host_id.client_service.name.raw": [
      "http",
      "tls",
      "dcerpc",
      "smb",
      "krb5"
    ],
    "tags.raw": [
      "beats_input_codec_json_applied"
    ],
    "host_id.username.user.raw": [
      "dmorgenstern@tangerinebox.tech"
    ],
    "host_id.tls.ja3.hash": [
      "3b5074b1b5d032e5620f69f9f700ff0e",
      "24c42d3e77f06f2a8f47f4ebbbfdfaf4",
      "28a2c9bd18a11de089ef85a160da29e4",
      "a0e9f5d64349fb13191bc781f81f42e1",
      "6271f898ce5be7dd52b0fc260d0662b3",
      "37f463bf4616ecd445d4a1937da06e19"
    ],
    "ip": [
      "172.18.127.129"
    ],
    "host_id.net_info.agg.raw": [
      "user.gcxga.org.affected-users"
    ],
    "agent.id.keyword": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "input.type": [
      "log"
    ],
    "log.offset": [
      77542198
    ],
    "agent.hostname": [
      "SSProbe-1"
    ],
    "input.type.raw": [
      "log"
    ],
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "host_id.http.user_agent.agent.raw": [
      "Microsoft-CryptoAPI/10.0"
    ],
    "see_name": [
      "stamus-central-server"
    ],
    "agent.id": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "host_id.tls.ja3.last_seen": [
      "2023-10-03T22:05:03.795Z",
      "2023-10-03T22:05:03.414Z",
      "2023-10-03T22:05:03.916Z",
      "2023-10-03T22:05:04.562Z",
      "2023-08-23T22:19:45.957Z",
      "2023-08-23T22:19:48.486Z"
    ],
    "logger.keyword": [
      "logstash-manager"
    ],
    "host_id.tls.ja3.string.raw": [
      "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0",
      "771,4865-4866-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0"
    ],
    "log.file.path.raw": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "host_id.net_info.last_seen": [
      "2023-08-23T22:26:01.177Z"
    ],
    "agent.version": [
      "7.17.10"
    ],
    "see_name.raw": [
      "stamus-central-server"
    ],
    "agent.id.raw": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "host_id.tls.ja3.hash.raw": [
      "3b5074b1b5d032e5620f69f9f700ff0e",
      "24c42d3e77f06f2a8f47f4ebbbfdfaf4",
      "28a2c9bd18a11de089ef85a160da29e4",
      "a0e9f5d64349fb13191bc781f81f42e1",
      "6271f898ce5be7dd52b0fc260d0662b3",
      "37f463bf4616ecd445d4a1937da06e19"
    ],
    "agent.hostname.raw": [
      "SSProbe-1"
    ],
    "host_id.username.user.keyword": [
      "dmorgenstern@tangerinebox.tech"
    ],
    "host_id.tls.ja3.agent.raw": [
      "Zalando/4.66.0 (Linux; Android 5.1.1; Samsung SM-N950N/greatlteks-user 5.1.1 NMF26X 500200226 release-keys)",
      "Mozills37.36",
      "XYZ Spider",
      "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; .NET CLR 4.1.70608;  MASEJS; rv:11.0) like Gecko",
      "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "input.type.keyword": [
      "log"
    ],
    "host_id.hostname.host.keyword": [
      "desktop-ufnm04v"
    ],
    "host_id.tls.ja3.string": [
      "771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0",
      "771,4865-4866-4866-4867-49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-23-65281-10-11-35-16-5-13-18-51-45-43-27-17513-21,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-65281,29-23-24,0",
      "771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0"
    ],
    "host_id.tls.ja3.agent": [
      "Zalando/4.66.0 (Linux; Android 5.1.1; Samsung SM-N950N/greatlteks-user 5.1.1 NMF26X 500200226 release-keys)",
      "Mozills37.36",
      "XYZ Spider",
      "Mozilla/5.0 (Windows NT 6.3; WOW64; Trident/7.0; .NET CLR 4.1.70608;  MASEJS; rv:11.0) like Gecko",
      "Mozilla/5.0 (Windows NT 6.2; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "tags.keyword": [
      "beats_input_codec_json_applied"
    ],
    "see_id.raw": [
      "2e2cf4a77cbd"
    ],
    "host_id.client_service.name": [
      "http",
      "tls",
      "dcerpc",
      "smb",
      "krb5"
    ],
    "host_id.net_info.agg": [
      "user.gcxga.org.affected-users"
    ],
    "event_type.keyword": [
      "host_id"
    ],
    "host_id.hostname.host.raw": [
      "desktop-ufnm04v"
    ],
    "agent.type": [
      "filebeat"
    ],
    "logger.raw": [
      "logstash-manager"
    ],
    "host_id.hostname.first_seen": [
      "2023-04-27T16:36:23.722Z"
    ],
    "host_id.first_seen": [
      "2023-04-27T16:36:22.274Z"
    ],
    "@version": [
      "1"
    ],
    "host_id.username.first_seen": [
      "2023-04-27T16:36:29.763Z"
    ],
    "agent.name.raw": [
      "SSProbe-1"
    ],
    "host_id.hostname.host": [
      "desktop-ufnm04v"
    ],
    "log.file.path.keyword": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "host_id.username.user": [
      "dmorgenstern@tangerinebox.tech"
    ],
    "agent.type.keyword": [
      "filebeat"
    ],
    "agent.ephemeral_id.keyword": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "host_id.http.user_agent.agent.keyword": [
      "Microsoft-CryptoAPI/10.0"
    ],
    "host_id.net_info.first_seen": [
      "2023-08-23T22:19:44.130Z"
    ],
    "host_id.http.user_agent.last_seen": [
      "2023-08-23T22:19:46.700Z"
    ],
    "agent.name.keyword": [
      "SSProbe-1"
    ],
    "host.raw": [
      "SSProbe-1"
    ],
    "host_id.http.user_agent.first_seen": [
      "2023-04-27T16:36:27.129Z"
    ],
    "type.raw": [
      "json-log"
    ],
    "agent.ephemeral_id.raw": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "agent.type.raw": [
      "filebeat"
    ],
    "@timestamp": [
      "2023-10-03T22:05:08.439Z"
    ],
    "event_type.raw": [
      "host_id"
    ],
    "log.file.path": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "agent.ephemeral_id": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "host_id.http.user_agent.agent": [
      "Microsoft-CryptoAPI/10.0"
    ],
    "see_id": [
      "2e2cf4a77cbd"
    ],
    "host_id.client_service.name.keyword": [
      "http",
      "tls",
      "dcerpc",
      "smb",
      "krb5"
    ],
    "host_id.last_seen": [
      "2023-10-03T22:05:03.406Z"
    ]
  }
}