{
  "_index": "logstash-http-2022.09.11",
  "_type": "_doc",
  "_id": "QvmLLYMBfTCdXV7aEK0p",
  "_version": 1,
  "_score": null,
  "_source": {
    "input": {
      "type": "log"
    },
    "proto": "TCP",
    "http": {
      "accept_language": "en-US",
      "http_method": "POST",
      "content_length": "154",
      "date": "Thu, 09 Jul 2020 19:16:10 GMT",
      "request_headers": [
        {
          "value": "www.donateoneeight.net",
          "name": "Host"
        },
        {
          "value": "close",
          "name": "Connection"
        },
        {
          "value": "283000",
          "name": "Content-Length"
        },
        {
          "value": "no-cache",
          "name": "Cache-Control"
        },
        {
          "value": "http://www.donateoneeight.net",
          "name": "Origin"
        },
        {
          "value": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
          "name": "User-Agent"
        },
        {
          "value": "application/x-www-form-urlencoded",
          "name": "Content-Type"
        },
        {
          "value": "*/*",
          "name": "Accept"
        },
        {
          "value": "http://www.donateoneeight.net/ns424/",
          "name": "Referer"
        },
        {
          "value": "en-US",
          "name": "Accept-Language"
        },
        {
          "value": "gzip, deflate",
          "name": "Accept-Encoding"
        }
      ],
      "content_type": "text/html",
      "url": "/ns424/",
      "protocol": "HTTP/1.1",
      "accept_encoding": "gzip, deflate",
      "http_content_type": "text/html",
      "allow": "GET, HEAD",
      "connection": "close",
      "accept": "*/*",
      "origin": "http://www.donateoneeight.net",
      "user_agent": {
        "device": "Other",
        "os": "Windows",
        "os_name": "Windows",
        "minor": "0",
        "build": "",
        "major": "11",
        "name": "IE"
      },
      "length": 154,
      "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko",
      "cache_control": "no-cache",
      "status": 405,
      "http_refer_info": {
        "domain": "donateoneeight.net",
        "scheme": "http",
        "resource_path": "/ns424/",
        "host": "www.donateoneeight.net",
        "url": "http://www.donateoneeight.net/ns424/",
        "domain_without_tld": "donateoneeight",
        "tld": "net",
        "subdomain": "www"
      },
      "hostname": "www.donateoneeight.net",
      "response_headers": [
        {
          "value": "Thu, 09 Jul 2020 19:16:10 GMT",
          "name": "Date"
        },
        {
          "value": "text/html",
          "name": "Content-Type"
        },
        {
          "value": "154",
          "name": "Content-Length"
        },
        {
          "value": "close",
          "name": "Connection"
        },
        {
          "value": "namecheap-nginx",
          "name": "Server"
        },
        {
          "value": "GET, HEAD",
          "name": "Allow"
        }
      ],
      "server": "namecheap-nginx",
      "http_refer": "http://www.donateoneeight.net/ns424/"
    },
    "log": {
      "file": {
        "path": "/var/log/suricata/eve-0.json"
      },
      "offset": 549061559
    },
    "src_port": 49849,
    "see_id": "2e2cf4a77cbd",
    "hostname_info": {
      "domain": "donateoneeight.net",
      "url": "www.donateoneeight.net",
      "host": "www.donateoneeight.net",
      "domain_without_tld": "donateoneeight",
      "tld": "net",
      "subdomain": "www"
    },
    "src_ip": "10.6.9.101",
    "net_info": {
      "dest_agg": "bad_actor.oxmnb.bad.bad-users",
      "dest": [
        "BAD_ACTOR.oxmnb.bad",
        "BAD USERS"
      ]
    },
    "@version": "1",
    "@timestamp": "2022-09-11T17:13:54.373Z",
    "ether": {},
    "host": "SSProbe-1",
    "ecs": {
      "version": "1.12.0"
    },
    "dest_port": 80,
    "type": "json-log",
    "tags": [
      "beats_input_codec_json_applied"
    ],
    "tx_id": 0,
    "timestamp": "2022-09-11T19:13:54.373228+0200",
    "see_name": "stamus-central-server",
    "dest_ip": "198.54.117.217",
    "event_type": "http",
    "alerted": true,
    "agent": {
      "version": "7.16.1",
      "hostname": "SSProbe-1",
      "id": "9f305fa4-6db1-485c-81f9-598dce1469e3",
      "type": "filebeat",
      "ephemeral_id": "da6efa0f-f749-4bb3-8918-c3514cb604ff",
      "name": "SSProbe-1"
    },
    "in_iface": "tppdummy0",
    "flow_id": 1899288393209894
  },
  "fields": {
    "@timestamp": [
      "2022-09-11T17:13:54.373Z"
    ],
    "EveBox": [
      1899288393209894
    ],
    "timestamp": [
      "2022-09-11T17:13:54.373Z"
    ]
  },
  "sort": [
    1662916434373
  ]
}