{
  "_index": "logstash-host_id-2023.10.03",
  "_type": "_doc",
  "_id": "SSProbe-1_10.7.5.5_0",
  "_version": 1,
  "_score": 1,
  "_ignored": [
    "host_id.tls.ja3.string.raw",
    "host_id.tls.ja3.string.keyword"
  ],
  "_source": {
    "host_id": {
      "last_seen": "2023-10-03T19:23:51.612907+0200",
      "tls.ja3": [
        {
          "last_seen": "2023-08-23T19:22:52.600754+0200",
          "string": "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-10-11,23-24,0",
          "first_seen": "2023-04-27T13:38:48.715256+0200",
          "agent": [
            "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3868.400 QQBrowser/10.8.4394.400"
          ],
          "hash": "6734f37431670b3ab4292b8f60f29984"
        },
        {
          "last_seen": "2023-08-23T19:22:07.341403+0200",
          "string": "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-0-10-11,23-24,0",
          "first_seen": "2023-04-27T13:38:48.745844+0200",
          "agent": [
            "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705"
          ],
          "hash": "1d095e68489d3c535297cd8dffb06cb9"
        },
        {
          "last_seen": "2023-08-23T19:22:52.996684+0200",
          "string": "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
          "first_seen": "2023-04-27T13:39:06.951745+0200",
          "agent": [
            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.108 Safari/537.36"
          ],
          "hash": "398430069e0a8ecfbc8db0778d658d77"
        },
        {
          "last_seen": "2023-08-23T19:22:50.499050+0200",
          "string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10-27,29-23-24,0",
          "first_seen": "2023-04-27T13:39:31.896431+0200",
          "agent": [
            "ZhihuHybrid DefaultBrowser com.zhihu.android/Futureve/8.8.0 Mozilla/5.0 (Linux; Android 9; 16T Build/PKQ1.190616.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/70.0.3538.111 Mobile Safari/537.36"
          ],
          "hash": "5353c0796e25725adfdb93f35f5a18f7"
        },
        {
          "last_seen": "2023-08-23T19:22:50.541402+0200",
          "string": "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10-27,29-23-24,0",
          "first_seen": "2023-04-27T13:39:31.945857+0200",
          "agent": [
            "visual studio code 1.37.0-insider electron 4.2.5 ubuntu 18.04"
          ],
          "hash": "717217c022d59183bfde190cd3ff072f"
        }
      ],
      "hostname": [
        {
          "host": "phantasmedia-dc.phantasmedia.com",
          "last_seen": "2023-10-03T19:23:50.974014+0200",
          "first_seen": "2023-04-27T13:38:36.764686+0200"
        }
      ],
      "services": [
        {
          "port": 53,
          "values": [
            {
              "last_seen": "2023-10-03T19:23:53.751837+0200",
              "app_proto": "dns",
              "first_seen": "2023-04-27T13:38:36.762324+0200"
            }
          ],
          "proto": "udp",
          "overflow": 0
        },
        {
          "port": 67,
          "values": [
            {
              "last_seen": "2023-10-03T19:23:51.400685+0200",
              "app_proto": "dhcp",
              "first_seen": "2023-04-27T13:38:37.216458+0200"
            }
          ],
          "proto": "udp",
          "overflow": 0
        },
        {
          "port": 88,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:14.180823+0200",
              "app_proto": "krb5",
              "first_seen": "2023-04-27T13:38:39.652117+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 389,
          "values": [
            {
              "last_seen": "2023-10-03T19:23:54.189837+0200",
              "app_proto": "unknown",
              "first_seen": "2023-04-27T13:38:40.333394+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 445,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:52.162215+0200",
              "app_proto": "smb",
              "first_seen": "2023-04-27T13:38:43.021274+0200"
            },
            {
              "last_seen": "2023-08-23T19:22:53.501727+0200",
              "app_proto": "unknown",
              "first_seen": "2023-04-27T13:38:47.064560+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 49155,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:33.334571+0200",
              "app_proto": "dcerpc",
              "first_seen": "2023-04-27T13:38:44.366089+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 3268,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:53.492467+0200",
              "app_proto": "unknown",
              "first_seen": "2023-04-27T13:38:46.393045+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 135,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:50.134014+0200",
              "app_proto": "dcerpc",
              "first_seen": "2023-04-27T13:38:47.058052+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        },
        {
          "port": 49158,
          "values": [
            {
              "last_seen": "2023-08-23T19:22:10.489303+0200",
              "app_proto": "dcerpc",
              "first_seen": "2023-04-27T13:38:50.423695+0200"
            }
          ],
          "proto": "tcp",
          "overflow": 0
        }
      ],
      "net_info": [
        {
          "last_seen": "2023-08-23T19:28:59.544326+0200",
          "agg": "user.hxcas.org.affected-users",
          "first_seen": "2023-07-06T10:17:12.050143+0200"
        }
      ],
      "first_seen": "2023-04-27T13:38:36.762324+0200",
      "client_service": [
        {
          "name": "tls",
          "last_seen": "2023-08-23T19:28:56.188243+0200",
          "first_seen": "2023-04-27T13:38:55.133295+0200"
        },
        {
          "name": "http",
          "last_seen": "2023-08-23T19:22:48.111555+0200",
          "first_seen": "2023-04-27T13:38:57.142486+0200"
        },
        {
          "name": "smb",
          "last_seen": "2023-08-23T19:22:23.250075+0200",
          "first_seen": "2023-04-27T13:39:05.192634+0200"
        }
      ],
      "roles": [
        {
          "last_seen": "2023-10-03T19:23:54.189837+0200",
          "name": "dhcp",
          "first_seen": "2023-04-27T13:38:37.216458+0200"
        },
        {
          "last_seen": "2023-10-03T19:23:54.189837+0200",
          "name": "domain controller",
          "first_seen": "2023-04-27T13:38:43.021274+0200"
        }
      ],
      "http.user_agent": [
        {
          "last_seen": "2023-08-23T19:22:12.068453+0200",
          "first_seen": "2023-04-27T13:38:51.399965+0200",
          "agent": "test"
        },
        {
          "last_seen": "2023-08-23T19:22:10.110819+0200",
          "first_seen": "2023-04-27T13:38:51.515262+0200",
          "agent": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)"
        },
        {
          "last_seen": "2023-08-23T19:22:11.703756+0200",
          "first_seen": "2023-04-27T13:38:53.108859+0200",
          "agent": "WinHTTP sender/1.0"
        },
        {
          "last_seen": "2023-08-23T19:22:12.937862+0200",
          "first_seen": "2023-04-27T13:38:53.850553+0200",
          "agent": "WinHTTP loader/1.0"
        },
        {
          "last_seen": "2023-08-23T19:22:52.117862+0200",
          "first_seen": "2023-04-27T13:39:10.464667+0200",
          "agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
        }
      ]
    },
    "host": "SSProbe-1",
    "see_name": "stamus-central-server",
    "agent": {
      "ephemeral_id": "6bc88545-186c-47b6-8fd4-1b865c59f0e1",
      "hostname": "SSProbe-1",
      "id": "9f305fa4-6db1-485c-81f9-598dce1469e3",
      "type": "filebeat",
      "version": "7.17.10",
      "name": "SSProbe-1"
    },
    "type": "json-log",
    "log": {
      "file": {
        "path": "/var/log/suricata/eve-host_id-0.json"
      },
      "offset": 35411183
    },
    "logger": "logstash-manager",
    "worker": 0,
    "event_type": "host_id",
    "@version": "1",
    "input": {
      "type": "log"
    },
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "see_id": "2e2cf4a77cbd",
    "@timestamp": "2023-10-03T17:23:59.547Z",
    "ip": "10.7.5.5"
  },
  "fields": {
    "agent.version.keyword": [
      "7.17.10"
    ],
    "logger": [
      "logstash-manager"
    ],
    "type": [
      "json-log"
    ],
    "host_id.services.values.app_proto.raw": [
      "dns",
      "dhcp",
      "krb5",
      "unknown",
      "smb",
      "unknown",
      "dcerpc",
      "unknown",
      "dcerpc",
      "dcerpc"
    ],
    "event_type": [
      "host_id"
    ],
    "host_id.tls.ja3.agent.keyword": [
      "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3868.400 QQBrowser/10.8.4394.400",
      "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705",
      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.108 Safari/537.36",
      "ZhihuHybrid DefaultBrowser com.zhihu.android/Futureve/8.8.0 Mozilla/5.0 (Linux; Android 9; 16T Build/PKQ1.190616.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/70.0.3538.111 Mobile Safari/537.36",
      "visual studio code 1.37.0-insider electron 4.2.5 ubuntu 18.04"
    ],
    "host_id.tls.ja3.first_seen": [
      "2023-04-27T11:38:48.715Z",
      "2023-04-27T11:38:48.745Z",
      "2023-04-27T11:39:06.951Z",
      "2023-04-27T11:39:31.896Z",
      "2023-04-27T11:39:31.945Z"
    ],
    "agent.name": [
      "SSProbe-1"
    ],
    "worker": [
      0
    ],
    "host_id.client_service.name.raw": [
      "tls",
      "http",
      "smb"
    ],
    "host_id.tls.ja3.hash": [
      "6734f37431670b3ab4292b8f60f29984",
      "1d095e68489d3c535297cd8dffb06cb9",
      "398430069e0a8ecfbc8db0778d658d77",
      "5353c0796e25725adfdb93f35f5a18f7",
      "717217c022d59183bfde190cd3ff072f"
    ],
    "ip": [
      "10.7.5.5"
    ],
    "agent.id.keyword": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "input.type": [
      "log"
    ],
    "agent.hostname": [
      "SSProbe-1"
    ],
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "see_name": [
      "stamus-central-server"
    ],
    "agent.id": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "host_id.tls.ja3.last_seen": [
      "2023-08-23T17:22:52.600Z",
      "2023-08-23T17:22:07.341Z",
      "2023-08-23T17:22:52.996Z",
      "2023-08-23T17:22:50.499Z",
      "2023-08-23T17:22:50.541Z"
    ],
    "agent.id.raw": [
      "9f305fa4-6db1-485c-81f9-598dce1469e3"
    ],
    "host_id.tls.ja3.hash.raw": [
      "6734f37431670b3ab4292b8f60f29984",
      "1d095e68489d3c535297cd8dffb06cb9",
      "398430069e0a8ecfbc8db0778d658d77",
      "5353c0796e25725adfdb93f35f5a18f7",
      "717217c022d59183bfde190cd3ff072f"
    ],
    "agent.hostname.raw": [
      "SSProbe-1"
    ],
    "host_id.tls.ja3.agent.raw": [
      "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3868.400 QQBrowser/10.8.4394.400",
      "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705",
      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.108 Safari/537.36",
      "ZhihuHybrid DefaultBrowser com.zhihu.android/Futureve/8.8.0 Mozilla/5.0 (Linux; Android 9; 16T Build/PKQ1.190616.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/70.0.3538.111 Mobile Safari/537.36",
      "visual studio code 1.37.0-insider electron 4.2.5 ubuntu 18.04"
    ],
    "input.type.keyword": [
      "log"
    ],
    "host_id.hostname.host.keyword": [
      "phantasmedia-dc.phantasmedia.com"
    ],
    "host_id.tls.ja3.string": [
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-10-11,23-24,0",
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-0-10-11,23-24,0",
      "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10-27,29-23-24,0",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10-27,29-23-24,0"
    ],
    "host_id.tls.ja3.agent": [
      "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.25 Safari/537.36 Core/1.70.3868.400 QQBrowser/10.8.4394.400",
      "User-Agent:Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705",
      "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.108 Safari/537.36",
      "ZhihuHybrid DefaultBrowser com.zhihu.android/Futureve/8.8.0 Mozilla/5.0 (Linux; Android 9; 16T Build/PKQ1.190616.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/70.0.3538.111 Mobile Safari/537.36",
      "visual studio code 1.37.0-insider electron 4.2.5 ubuntu 18.04"
    ],
    "tags.keyword": [
      "beats_input_codec_json_applied"
    ],
    "see_id.raw": [
      "2e2cf4a77cbd"
    ],
    "host_id.client_service.name": [
      "tls",
      "http",
      "smb"
    ],
    "host_id.net_info.agg": [
      "user.hxcas.org.affected-users"
    ],
    "host_id.roles.last_seen": [
      "2023-10-03T17:23:54.189Z",
      "2023-10-03T17:23:54.189Z"
    ],
    "agent.type": [
      "filebeat"
    ],
    "logger.raw": [
      "logstash-manager"
    ],
    "host_id.hostname.first_seen": [
      "2023-04-27T11:38:36.764Z"
    ],
    "agent.name.raw": [
      "SSProbe-1"
    ],
    "agent.type.keyword": [
      "filebeat"
    ],
    "agent.ephemeral_id.keyword": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "host_id.http.user_agent.last_seen": [
      "2023-08-23T17:22:12.068Z",
      "2023-08-23T17:22:10.110Z",
      "2023-08-23T17:22:11.703Z",
      "2023-08-23T17:22:12.937Z",
      "2023-08-23T17:22:52.117Z"
    ],
    "agent.name.keyword": [
      "SSProbe-1"
    ],
    "agent.ephemeral_id.raw": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "agent.type.raw": [
      "filebeat"
    ],
    "@timestamp": [
      "2023-10-03T17:23:59.547Z"
    ],
    "host_id.roles.first_seen": [
      "2023-04-27T11:38:37.216Z",
      "2023-04-27T11:38:43.021Z"
    ],
    "log.file.path": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "agent.ephemeral_id": [
      "6bc88545-186c-47b6-8fd4-1b865c59f0e1"
    ],
    "host_id.http.user_agent.agent": [
      "test",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)",
      "WinHTTP sender/1.0",
      "WinHTTP loader/1.0",
      "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "see_id": [
      "2e2cf4a77cbd"
    ],
    "host_id.tls.ja3.hash.keyword": [
      "6734f37431670b3ab4292b8f60f29984",
      "1d095e68489d3c535297cd8dffb06cb9",
      "398430069e0a8ecfbc8db0778d658d77",
      "5353c0796e25725adfdb93f35f5a18f7",
      "717217c022d59183bfde190cd3ff072f"
    ],
    "host_id.client_service.last_seen": [
      "2023-08-23T17:28:56.188Z",
      "2023-08-23T17:22:48.111Z",
      "2023-08-23T17:22:23.250Z"
    ],
    "host_id.net_info.agg.keyword": [
      "user.hxcas.org.affected-users"
    ],
    "host_id.client_service.first_seen": [
      "2023-04-27T11:38:55.133Z",
      "2023-04-27T11:38:57.142Z",
      "2023-04-27T11:39:05.192Z"
    ],
    "host_id.tls.ja3.string.keyword": [
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-10-11,23-24,0",
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-0-10-11,23-24,0",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10-27,29-23-24,0",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10-27,29-23-24,0"
    ],
    "agent.hostname.keyword": [
      "SSProbe-1"
    ],
    "see_id.keyword": [
      "2e2cf4a77cbd"
    ],
    "type.keyword": [
      "json-log"
    ],
    "see_name.keyword": [
      "stamus-central-server"
    ],
    "host_id.services.values.last_seen": [
      "2023-10-03T17:23:53.751Z",
      "2023-10-03T17:23:51.400Z",
      "2023-08-23T17:22:14.180Z",
      "2023-10-03T17:23:54.189Z",
      "2023-08-23T17:22:52.162Z",
      "2023-08-23T17:22:53.501Z",
      "2023-08-23T17:22:33.334Z",
      "2023-08-23T17:22:53.492Z",
      "2023-08-23T17:22:50.134Z",
      "2023-08-23T17:22:10.489Z"
    ],
    "host": [
      "SSProbe-1"
    ],
    "host.keyword": [
      "SSProbe-1"
    ],
    "agent.version.raw": [
      "7.17.10"
    ],
    "host_id.hostname.last_seen": [
      "2023-10-03T17:23:50.974Z"
    ],
    "tags.raw": [
      "beats_input_codec_json_applied"
    ],
    "host_id.net_info.agg.raw": [
      "user.hxcas.org.affected-users"
    ],
    "log.offset": [
      35411183
    ],
    "input.type.raw": [
      "log"
    ],
    "host_id.services.values.app_proto": [
      "dns",
      "dhcp",
      "krb5",
      "unknown",
      "smb",
      "unknown",
      "dcerpc",
      "unknown",
      "dcerpc",
      "dcerpc"
    ],
    "host_id.http.user_agent.agent.raw": [
      "test",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)",
      "WinHTTP sender/1.0",
      "WinHTTP loader/1.0",
      "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "logger.keyword": [
      "logstash-manager"
    ],
    "host_id.tls.ja3.string.raw": [
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-10-11,23-24,0",
      "769,47-53-5-10-49171-49172-49161-49162-50-56-19-4,65281-0-10-11,23-24,0",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-11-10-27,29-23-24,0",
      "771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53-10,65281-0-23-35-13-5-18-16-30032-11-10-27,29-23-24,0"
    ],
    "log.file.path.raw": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "host_id.net_info.last_seen": [
      "2023-08-23T17:28:59.544Z"
    ],
    "agent.version": [
      "7.17.10"
    ],
    "see_name.raw": [
      "stamus-central-server"
    ],
    "host_id.roles.name.raw": [
      "dhcp",
      "domain controller"
    ],
    "host_id.services.values.first_seen": [
      "2023-04-27T11:38:36.762Z",
      "2023-04-27T11:38:37.216Z",
      "2023-04-27T11:38:39.652Z",
      "2023-04-27T11:38:40.333Z",
      "2023-04-27T11:38:43.021Z",
      "2023-04-27T11:38:47.064Z",
      "2023-04-27T11:38:44.366Z",
      "2023-04-27T11:38:46.393Z",
      "2023-04-27T11:38:47.058Z",
      "2023-04-27T11:38:50.423Z"
    ],
    "event_type.keyword": [
      "host_id"
    ],
    "host_id.hostname.host.raw": [
      "phantasmedia-dc.phantasmedia.com"
    ],
    "host_id.services.proto.keyword": [
      "udp",
      "udp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp"
    ],
    "host_id.services.port": [
      53,
      67,
      88,
      389,
      445,
      49155,
      3268,
      135,
      49158
    ],
    "host_id.services.overflow": [
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0,
      0
    ],
    "host_id.services.values.app_proto.keyword": [
      "dns",
      "dhcp",
      "krb5",
      "unknown",
      "smb",
      "unknown",
      "dcerpc",
      "unknown",
      "dcerpc",
      "dcerpc"
    ],
    "host_id.first_seen": [
      "2023-04-27T11:38:36.762Z"
    ],
    "@version": [
      "1"
    ],
    "host_id.hostname.host": [
      "phantasmedia-dc.phantasmedia.com"
    ],
    "log.file.path.keyword": [
      "/var/log/suricata/eve-host_id-0.json"
    ],
    "host_id.roles.name.keyword": [
      "dhcp",
      "domain controller"
    ],
    "host_id.http.user_agent.agent.keyword": [
      "test",
      "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)",
      "WinHTTP sender/1.0",
      "WinHTTP loader/1.0",
      "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko"
    ],
    "host_id.net_info.first_seen": [
      "2023-07-06T08:17:12.050Z"
    ],
    "host_id.services.proto": [
      "udp",
      "udp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp"
    ],
    "host.raw": [
      "SSProbe-1"
    ],
    "host_id.http.user_agent.first_seen": [
      "2023-04-27T11:38:51.399Z",
      "2023-04-27T11:38:51.515Z",
      "2023-04-27T11:38:53.108Z",
      "2023-04-27T11:38:53.850Z",
      "2023-04-27T11:39:10.464Z"
    ],
    "host_id.roles.name": [
      "dhcp",
      "domain controller"
    ],
    "type.raw": [
      "json-log"
    ],
    "event_type.raw": [
      "host_id"
    ],
    "host_id.services.proto.raw": [
      "udp",
      "udp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp",
      "tcp"
    ],
    "host_id.client_service.name.keyword": [
      "tls",
      "http",
      "smb"
    ],
    "host_id.last_seen": [
      "2023-10-03T17:23:51.612Z"
    ]
  },
  "ignored_field_values": {
    "host_id.tls.ja3.string.keyword": [
      "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2"
    ],
    "host_id.tls.ja3.string.raw": [
      "771,4866-4867-4865-49199-49195-49200-49196-158-49191-103-49192-107-163-159-52393-52392-52394-49327-49325-49315-49311-49245-49249-49239-49235-162-49326-49324-49314-49310-49244-49248-49238-49234-49188-106-49187-64-49162-49172-57-56-49161-49171-51-50-157-49313-49309-49233-156-49312-49308-49232-61-60-53-47-255,0-11-10-35-22-23-13-43-45-51,29-23-30-25-24,0-1-2"
    ]
  }
}