Darktrace

{
    "@timestamp": "2021-08-03T14:48:09.240Z",
    "agent": {
        "ephemeral_id": "315a1a3f-bc7a-4a11-9540-c316f1ec95ee",
        "id": "85270a54-b915-4d11-9305-d004346cb8cf",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.9.0"
    },
    "darktrace": {
        "ai_analyst_alert": {
            "activity_id": "abcd1234",
            "aia_score": 98,
            "attack_phases": [
                5
            ],
            "breach_devices": [
                {
                    "did": 10,
                    "ip": "81.2.69.144",
                    "sid": 12,
                    "subnet": "VPN"
                }
            ],
            "category": "critical",
            "children": [
                "eabcdef0-1234-1234-1234-cabcdefghij9"
            ],
            "created_at": "2021-08-03T14:48:09.240Z",
            "current_group": "eabc1234-1234-1234-1234-cabcdefg0011",
            "details": [
                [
                    {
                        "contents": [
                            {
                                "type": "device",
                                "values": [
                                    {
                                        "did": 10,
                                        "ip": "175.16.199.1",
                                        "sid": 12,
                                        "subnet": "VPN"
                                    }
                                ]
                            }
                        ],
                        "header": "Breaching Device"
                    }
                ],
                [
                    {
                        "contents": [
                            {
                                "key": "Time",
                                "type": "timestampRange",
                                "values": [
                                    {
                                        "end": 1628000141220,
                                        "start": 1627985298683
                                    }
                                ]
                            },
                            {
                                "key": "Number of unique IPs",
                                "type": "integer",
                                "values": [
                                    16
                                ]
                            },
                            {
                                "key": "Targeted IP ranges include",
                                "type": "device",
                                "values": [
                                    {
                                        "ip": "81.2.69.192"
                                    },
                                    {
                                        "ip": "175.16.199.1"
                                    },
                                    {
                                        "ip": "175.16.199.3"
                                    }
                                ]
                            },
                            {
                                "key": "Destination port",
                                "type": "integer",
                                "values": [
                                    22
                                ]
                            },
                            {
                                "key": "Connection count",
                                "type": "integer",
                                "values": [
                                    40
                                ]
                            },
                            {
                                "key": "Percentage successful",
                                "type": "percentage",
                                "values": [
                                    100
                                ]
                            }
                        ],
                        "header": "SSH Activity"
                    }
                ]
            ],
            "group_by_activity": false,
            "group_category": "critical",
            "group_score": 72.9174234,
            "grouping_ids": [
                "abcdef12"
            ],
            "id": "eabc0011-1234-1234-1234-cabcdefg0011",
            "is_acknowledged": false,
            "is_external_triggered": false,
            "is_pinned": true,
            "is_user_triggered": false,
            "periods": [
                {
                    "end": "2021-08-03T14:15:41.220Z",
                    "start": "2021-08-03T10:08:18.683Z"
                }
            ],
            "related_breaches": [
                {
                    "model_name": "Unusual Activity / Unusual Activity from Re-Activated Device",
                    "pbid": 1234,
                    "threat_score": 37,
                    "timestamp": "2021-08-03T13:25:57.000Z"
                }
            ],
            "summariser": "AdminConnSummary",
            "summary": "The device 175.16.199.1 was observed making unusual internal SSH connections to a wide range of devices.\n\nThough this behaviour could be the result of legitimate remote access or administration, it could also be a sign of attempted lateral movement by a compromised machine.\n\nConsequently, if this activity was not expected, the security team may wish to investigate further.",
            "title": "Extensive Unusual SSH Connections"
        }
    },
    "data_stream": {
        "dataset": "darktrace.ai_analyst_alert",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "85270a54-b915-4d11-9305-d004346cb8cf",
        "snapshot": true,
        "version": "8.9.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "darktrace.ai_analyst_alert",
        "duration": [
            14842537000000
        ],
        "end": [
            "2021-08-03T14:15:41.220Z"
        ],
        "id": "eabc0011-1234-1234-1234-cabcdefg0011",
        "ingested": "2023-06-14T17:00:35Z",
        "kind": "alert",
        "original": "{\"summariser\":\"AdminConnSummary\",\"acknowledged\":false,\"pinned\":true,\"createdAt\":1628002089240,\"attackPhases\":[5],\"title\":\"Extensive Unusual SSH Connections\",\"id\":\"eabc0011-1234-1234-1234-cabcdefg0011\",\"children\":[\"eabcdef0-1234-1234-1234-cabcdefghij9\"],\"category\":\"critical\",\"currentGroup\":\"eabc1234-1234-1234-1234-cabcdefg0011\",\"groupCategory\":\"critical\",\"groupScore\":\"72.9174234\",\"groupPreviousGroups\":null,\"activityId\":\"abcd1234\",\"groupingIds\":[\"abcdef12\"],\"groupByActivity\":false,\"userTriggered\":false,\"externalTriggered\":false,\"aiaScore\":98,\"summary\":\"The device 175.16.199.1 was observed making unusual internal SSH connections to a wide range of devices.\\n\\nThough this behaviour could be the result of legitimate remote access or administration, it could also be a sign of attempted lateral movement by a compromised machine.\\n\\nConsequently, if this activity was not expected, the security team may wish to investigate further.\",\"periods\":[{\"start\":1627985298683,\"end\":1628000141220}],\"breachDevices\":[{\"identifier\":null,\"hostname\":null,\"ip\":\"81.2.69.144\",\"mac\":null,\"subnet\":\"VPN\",\"did\":10,\"sid\":12}],\"relatedBreaches\":[{\"modelName\":\"Unusual Activity / Unusual Activity from Re-Activated Device\",\"pbid\":1234,\"threatScore\":37,\"timestamp\":1627997157000}],\"details\":[[{\"header\":\"Breaching Device\",\"contents\":[{\"key\":null,\"type\":\"device\",\"values\":[{\"identifier\":null,\"hostname\":null,\"ip\":\"175.16.199.1\",\"mac\":null,\"subnet\":\"VPN\",\"did\":10,\"sid\":12}]}]}],[{\"header\":\"SSH Activity\",\"contents\":[{\"key\":\"Time\",\"type\":\"timestampRange\",\"values\":[{\"start\":1627985298683,\"end\":1628000141220}]},{\"key\":\"Number of unique IPs\",\"type\":\"integer\",\"values\":[16]},{\"key\":\"Targeted IP ranges include\",\"type\":\"device\",\"values\":[{\"identifier\":null,\"hostname\":null,\"ip\":\"81.2.69.192\",\"mac\":null,\"subnet\":null,\"did\":null,\"sid\":null},{\"identifier\":null,\"hostname\":null,\"ip\":\"175.16.199.1\",\"mac\":null,\"subnet\":null,\"did\":null,\"sid\":null},{\"identifier\":null,\"hostname\":null,\"ip\":\"175.16.199.3\",\"mac\":null,\"subnet\":null,\"did\":null,\"sid\":null}]},{\"key\":\"Destination port\",\"type\":\"integer\",\"values\":[22]},{\"key\":\"Connection count\",\"type\":\"integer\",\"values\":[40]},{\"key\":\"Percentage successful\",\"type\":\"percentage\",\"values\":[100]}]}]]}",
        "reason": "Extensive Unusual SSH Connections",
        "risk_score": 98,
        "risk_score_norm": 98,
        "start": [
            "2021-08-03T10:08:18.683Z"
        ],
        "type": [
            "indicator"
        ]
    },
    "host": {
        "id": [
            "10"
        ],
        "ip": [
            "81.2.69.144"
        ]
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "source": {
            "address": "172.31.0.4:53890"
        },
        "syslog": {
            "facility": {
                "code": 20,
                "name": "local4"
            },
            "hostname": "example.cloud.darktrace.com",
            "priority": 165,
            "severity": {
                "code": 5,
                "name": "Notice"
            },
            "version": "1"
        }
    },
    "message": "The device 175.16.199.1 was observed making unusual internal SSH connections to a wide range of devices.\n\nThough this behaviour could be the result of legitimate remote access or administration, it could also be a sign of attempted lateral movement by a compromised machine.\n\nConsequently, if this activity was not expected, the security team may wish to investigate further.",
    "related": {
        "ip": [
            "81.2.69.144",
            "175.16.199.1",
            "81.2.69.192",
            "175.16.199.3"
        ]
    },
    "rule": {
        "name": [
            "Unusual Activity / Unusual Activity from Re-Activated Device"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "darktrace-ai_analyst_alert"
    ],
    "threat": {
        "enrichments": {
            "matched": {
                "id": [
                    "eabcdef0-1234-1234-1234-cabcdefghij9"
                ]
            }
        },
        "group": {
            "id": "eabc1234-1234-1234-1234-cabcdefg0011"
        }
    }
}

{
    "@timestamp": "2022-07-11T13:04:08.000Z",
    "agent": {
        "ephemeral_id": "ec882d5d-4e2f-46d7-9436-1bf500ebbe15",
        "id": "12398e67-5831-430a-bd92-515cfa993c86",
        "name": "elastic-agent-32495",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "darktrace": {
        "model_breach_alert": {
            "aianalyst_data": [
                {
                    "related": [
                        1
                    ],
                    "summariser": "BeaconSummary",
                    "uuid": "1234abcd-1234-1234-1234-123456abcdef"
                }
            ],
            "comment": {
                "count": 0
            },
            "creation_time": "2022-07-11T13:04:19.000Z",
            "device": {
                "did": 3,
                "first_seen": "2022-07-11T12:54:49.000Z",
                "ip": "81.2.69.142",
                "last_seen": "2022-07-11T13:00:18.000Z",
                "sid": 1,
                "type_label": "Desktop",
                "type_name": "desktop"
            },
            "is_acknowledged": false,
            "model": {
                "actions": {
                    "is_alerting": true,
                    "is_breach": true,
                    "is_priority_set": false,
                    "is_tag_set": false,
                    "is_type_set": false,
                    "model": true
                },
                "active_times": {
                    "type": "exclusions",
                    "version": 2
                },
                "behaviour": "incdec1",
                "category": "Informational",
                "created": {
                    "by": "System"
                },
                "delay": 0,
                "description": "A device has been repeatedly connecting to a rare external location with a beacon score. A beacon score is added when Darktrace identifies that a device is regularly communicating with an endpoint, for example, if a device connects to a rare external endpoint every 12 minutes this would get a beacon score. This model is designed to identify beaconing at a lower threshold and be protocol agnostic.\\n\\nAction: Review the external domains and IPs being connected to to see if they are legitimate and would be expected for business purposes.",
                "edited": {
                    "by": "System"
                },
                "in_compliance_behavior_category": false,
                "interval": 10800,
                "is_active": true,
                "is_auto_suppress": true,
                "is_auto_updatable": true,
                "is_auto_update": true,
                "is_sequenced": false,
                "is_shared_endpoints": false,
                "logic": {
                    "data_weighted_component_list": [
                        {
                            "cid": 2026,
                            "weight": 1
                        },
                        {
                            "cid": 2024,
                            "weight": 1
                        },
                        {
                            "cid": 2025,
                            "weight": -100
                        }
                    ],
                    "target_score": 1,
                    "type": "weightedComponentList",
                    "version": 1
                },
                "modified": "2022-07-11T11:47:37.000Z",
                "name": "Compromise::Beaconing Activity To External Rare",
                "phid": 1072,
                "pid": 156,
                "priority": 2,
                "tags": [
                    "AP: C2 Comms"
                ],
                "throttle": 10800,
                "uuid": "1234abcd-1234-1234-1234-123456abcdef",
                "version": 23
            },
            "pbid": 1,
            "score": 0.674,
            "time": "2022-07-11T13:04:08.000Z",
            "triggered_components": [
                {
                    "cbid": 1,
                    "chid": 2113,
                    "cid": 2026,
                    "interval": 3600,
                    "logic": {
                        "data": "{left={left=A, right={left=AA, right={left=AC, right={left=AD, right={left=AF, right={left=AG, right={left=AH, right={left=B, right={left=C, right={left=D, right={left=E, right={left=H, right={left=I, right={left=J, right={left=K, right={left=L, right={left=M, right={left=N, right={left=O, right={left=P, right={left=S, right={left=U, right={left=V, right={left=X, right={left=Y, right=Z, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, right={left=A, right={left=AA, right={left=AB, right={left=AE, right={left=AF, right={left=AG, right={left=AH, right={left=C, right={left=D, right={left=E, right={left=H, right={left=I, right={left=J, right={left=K, right={left=L, right={left=M, right={left=N, right={left=O, right={left=P, right={left=S, right={left=U, right={left=V, right={left=X, right={left=Y, right=Z, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=AND}, operator=OR}",
                        "version": "v0.1"
                    },
                    "metric": {
                        "label": "External Connections",
                        "mlid": 1,
                        "name": "externalconnections"
                    },
                    "size": 11,
                    "threshold": 10,
                    "time": "2022-07-11T13:04:08.000Z",
                    "triggered_filters": [
                        {
                            "arguments": {
                                "value": 60
                            },
                            "cfid": 23426,
                            "comparator_type": ">",
                            "filter_type": "Beaconing score",
                            "id": "A",
                            "trigger": {
                                "value": "100"
                            }
                        },
                        {
                            "arguments": {
                                "value": 0
                            },
                            "cfid": 23427,
                            "comparator_type": ">",
                            "filter_type": "Individual size up",
                            "id": "AA",
                            "trigger": {
                                "value": "4382"
                            }
                        },
                        {
                            "arguments": {
                                "value": 95
                            },
                            "cfid": 23428,
                            "comparator_type": ">",
                            "filter_type": "Rare domain",
                            "id": "AB",
                            "trigger": {
                                "value": "100"
                            }
                        },
                        {
                            "arguments": {
                                "value": 1209600
                            },
                            "cfid": 23430,
                            "comparator_type": "<",
                            "filter_type": "Age of destination",
                            "id": "AD",
                            "trigger": {
                                "value": "558"
                            }
                        },
                        {
                            "arguments": {
                                "value": 1209600
                            },
                            "cfid": 23431,
                            "comparator_type": "<",
                            "filter_type": "Age of external hostname",
                            "id": "AE",
                            "trigger": {
                                "value": "558"
                            }
                        },
                        {
                            "arguments": {
                                "value": "examples"
                            },
                            "cfid": 23432,
                            "comparator_type": "does not match regular expression",
                            "filter_type": "Connection hostname",
                            "id": "AF",
                            "trigger": {
                                "value": "example.com"
                            }
                        },
                        {
                            "arguments": {
                                "value": "examples"
                            },
                            "cfid": 23433,
                            "comparator_type": "does not match regular expression",
                            "filter_type": "ASN",
                            "id": "AG",
                            "trigger": {
                                "value": "AS12345 LOCAL-02"
                            }
                        },
                        {
                            "arguments": {
                                "value": "5d41402abc4b2a76b9719d911017c592"
                            },
                            "cfid": 23434,
                            "comparator_type": "does not match",
                            "filter_type": "JA3 hash",
                            "id": "AH",
                            "trigger": {
                                "value": "5d41402abc4b2a76b9719d911017c592"
                            }
                        },
                        {
                            "arguments": {
                                "value": 95
                            },
                            "cfid": 23435,
                            "comparator_type": ">",
                            "filter_type": "Rare external IP",
                            "id": "B",
                            "trigger": {
                                "value": "100"
                            }
                        },
                        {
                            "arguments": {
                                "value": "1003"
                            },
                            "cfid": 23436,
                            "comparator_type": "is not",
                            "filter_type": "Application protocol",
                            "id": "C",
                            "trigger": {
                                "value": "1004"
                            }
                        },
                        {
                            "arguments": {
                                "value": 53
                            },
                            "cfid": 23437,
                            "comparator_type": "!=",
                            "filter_type": "Destination port",
                            "id": "D",
                            "trigger": {
                                "value": "443"
                            }
                        },
                        {
                            "arguments": {
                                "value": "out"
                            },
                            "cfid": 23438,
                            "comparator_type": "is",
                            "filter_type": "Direction",
                            "id": "E",
                            "trigger": {
                                "value": "out"
                            }
                        },
                        {
                            "arguments": {
                                "value": 137
                            },
                            "cfid": 23439,
                            "comparator_type": "!=",
                            "filter_type": "Destination port",
                            "id": "H",
                            "trigger": {
                                "value": "443"
                            }
                        },
                        {
                            "arguments": {
                                "value": 161
                            },
                            "cfid": 23440,
                            "comparator_type": "!=",
                            "filter_type": "Destination port",
                            "id": "I",
                            "trigger": {
                                "value": "443"
                            }
                        },
                        {
                            "arguments": {
                                "value": "6"
                            },
                            "cfid": 23441,
                            "comparator_type": "is",
                            "filter_type": "Protocol",
                            "id": "J",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "Company"
                            },
                            "cfid": 23442,
                            "comparator_type": "does not contain",
                            "filter_type": "ASN",
                            "id": "K",
                            "trigger": {
                                "value": "AS12345 LOCAL-02"
                            }
                        },
                        {
                            "arguments": {
                                "value": "Company"
                            },
                            "cfid": 23443,
                            "comparator_type": "does not contain",
                            "filter_type": "ASN",
                            "id": "L",
                            "trigger": {
                                "value": "AS12345 LOCAL-02"
                            }
                        },
                        {
                            "arguments": {
                                "value": "13"
                            },
                            "cfid": 23444,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "M",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "5"
                            },
                            "cfid": 23445,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "N",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "9"
                            },
                            "cfid": 23446,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "O",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "12"
                            },
                            "cfid": 23447,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "P",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "30"
                            },
                            "cfid": 23448,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "S",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "4"
                            },
                            "cfid": 23449,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "U",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "3"
                            },
                            "cfid": 23450,
                            "comparator_type": "is not",
                            "filter_type": "Internal source device type",
                            "id": "V",
                            "trigger": {
                                "value": "6"
                            }
                        },
                        {
                            "arguments": {
                                "value": "false"
                            },
                            "cfid": 23451,
                            "comparator_type": "is",
                            "filter_type": "Trusted hostname",
                            "id": "X",
                            "trigger": {
                                "value": "false"
                            }
                        },
                        {
                            "arguments": {
                                "value": 26
                            },
                            "cfid": 23452,
                            "comparator_type": "does not have tag",
                            "filter_type": "Tagged internal source",
                            "id": "Y",
                            "trigger": {
                                "tag": {
                                    "data": {
                                        "auto": false,
                                        "color": 5,
                                        "visibility": "Public"
                                    },
                                    "expiry": 0,
                                    "is_referenced": true,
                                    "name": "No Device Tracking",
                                    "restricted": false,
                                    "thid": 26,
                                    "tid": 26
                                },
                                "value": "26"
                            }
                        },
                        {
                            "arguments": {
                                "value": 0
                            },
                            "cfid": 23453,
                            "comparator_type": ">",
                            "filter_type": "Individual size down",
                            "id": "Z",
                            "trigger": {
                                "value": "5862"
                            }
                        },
                        {
                            "cfid": 23454,
                            "comparator_type": "display",
                            "filter_type": "JA3 hash",
                            "id": "d1",
                            "trigger": {
                                "value": "5d41402abc4b2a76b9719d911017c592"
                            }
                        },
                        {
                            "cfid": 23455,
                            "comparator_type": "display",
                            "filter_type": "ASN",
                            "id": "d2",
                            "trigger": {
                                "value": "AS12345 LOCAL-02"
                            }
                        },
                        {
                            "cfid": 23456,
                            "comparator_type": "display",
                            "filter_type": "Destination IP",
                            "id": "d3",
                            "trigger": {
                                "value": "81.2.69.192"
                            }
                        },
                        {
                            "cfid": 23457,
                            "comparator_type": "display",
                            "filter_type": "Connection hostname",
                            "id": "d4",
                            "trigger": {
                                "value": "example.com"
                            }
                        }
                    ]
                }
            ]
        }
    },
    "data_stream": {
        "dataset": "darktrace.model_breach_alert",
        "namespace": "56997",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "12398e67-5831-430a-bd92-515cfa993c86",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "created": "2022-07-11T13:04:19.000Z",
        "dataset": "darktrace.model_breach_alert",
        "ingested": "2024-10-25T03:45:44Z",
        "kind": "event",
        "original": "{\"commentCount\":0,\"pbid\":1,\"time\":1657544648000,\"creationTime\":1657544659000,\"aianalystData\":[{\"uuid\":\"1234abcd-1234-1234-1234-123456abcdef\",\"related\":[1],\"summariser\":\"BeaconSummary\"}],\"model\":{\"name\":\"Compromise::Beaconing Activity To External Rare\",\"pid\":156,\"phid\":1072,\"uuid\":\"1234abcd-1234-1234-1234-123456abcdef\",\"logic\":{\"data\":[{\"cid\":2026,\"weight\":1},{\"cid\":2024,\"weight\":1},{\"cid\":2025,\"weight\":-100}],\"targetScore\":1,\"type\":\"weightedComponentList\",\"version\":1},\"throttle\":10800,\"sharedEndpoints\":false,\"actions\":{\"alert\":true,\"antigena\":{},\"breach\":true,\"model\":true,\"setPriority\":false,\"setTag\":false,\"setType\":false},\"tags\":[\"AP: C2 Comms\"],\"interval\":10800,\"delay\":0,\"sequenced\":false,\"active\":true,\"modified\":\"2022-07-11 11:47:37\",\"activeTimes\":{\"devices\":{},\"tags\":{},\"type\":\"exclusions\",\"version\":2},\"autoUpdatable\":true,\"autoUpdate\":true,\"autoSuppress\":true,\"description\":\"A device has been repeatedly connecting to a rare external location with a beacon score. A beacon score is added when Darktrace identifies that a device is regularly communicating with an endpoint, for example, if a device connects to a rare external endpoint every 12 minutes this would get a beacon score. This model is designed to identify beaconing at a lower threshold and be protocol agnostic.\\\\\n\\\\\nAction: Review the external domains and IPs being connected to to see if they are legitimate and would be expected for business purposes.\",\"behaviour\":\"incdec1\",\"created\":{\"by\":\"System\"},\"edited\":{\"by\":\"System\"},\"version\":23,\"priority\":2,\"category\":\"Informational\",\"compliance\":false},\"triggeredComponents\":[{\"time\":1657544648000,\"cbid\":1,\"cid\":2026,\"chid\":2113,\"size\":11,\"threshold\":10,\"interval\":3600,\"logic\":{\"data\":{\"left\":{\"left\":\"A\",\"operator\":\"AND\",\"right\":{\"left\":\"AA\",\"operator\":\"AND\",\"right\":{\"left\":\"AC\",\"operator\":\"AND\",\"right\":{\"left\":\"AD\",\"operator\":\"AND\",\"right\":{\"left\":\"AF\",\"operator\":\"AND\",\"right\":{\"left\":\"AG\",\"operator\":\"AND\",\"right\":{\"left\":\"AH\",\"operator\":\"AND\",\"right\":{\"left\":\"B\",\"operator\":\"AND\",\"right\":{\"left\":\"C\",\"operator\":\"AND\",\"right\":{\"left\":\"D\",\"operator\":\"AND\",\"right\":{\"left\":\"E\",\"operator\":\"AND\",\"right\":{\"left\":\"H\",\"operator\":\"AND\",\"right\":{\"left\":\"I\",\"operator\":\"AND\",\"right\":{\"left\":\"J\",\"operator\":\"AND\",\"right\":{\"left\":\"K\",\"operator\":\"AND\",\"right\":{\"left\":\"L\",\"operator\":\"AND\",\"right\":{\"left\":\"M\",\"operator\":\"AND\",\"right\":{\"left\":\"N\",\"operator\":\"AND\",\"right\":{\"left\":\"O\",\"operator\":\"AND\",\"right\":{\"left\":\"P\",\"operator\":\"AND\",\"right\":{\"left\":\"S\",\"operator\":\"AND\",\"right\":{\"left\":\"U\",\"operator\":\"AND\",\"right\":{\"left\":\"V\",\"operator\":\"AND\",\"right\":{\"left\":\"X\",\"operator\":\"AND\",\"right\":{\"left\":\"Y\",\"operator\":\"AND\",\"right\":\"Z\"}}}}}}}}}}}}}}}}}}}}}}}}},\"operator\":\"OR\",\"right\":{\"left\":\"A\",\"operator\":\"AND\",\"right\":{\"left\":\"AA\",\"operator\":\"AND\",\"right\":{\"left\":\"AB\",\"operator\":\"AND\",\"right\":{\"left\":\"AE\",\"operator\":\"AND\",\"right\":{\"left\":\"AF\",\"operator\":\"AND\",\"right\":{\"left\":\"AG\",\"operator\":\"AND\",\"right\":{\"left\":\"AH\",\"operator\":\"AND\",\"right\":{\"left\":\"C\",\"operator\":\"AND\",\"right\":{\"left\":\"D\",\"operator\":\"AND\",\"right\":{\"left\":\"E\",\"operator\":\"AND\",\"right\":{\"left\":\"H\",\"operator\":\"AND\",\"right\":{\"left\":\"I\",\"operator\":\"AND\",\"right\":{\"left\":\"J\",\"operator\":\"AND\",\"right\":{\"left\":\"K\",\"operator\":\"AND\",\"right\":{\"left\":\"L\",\"operator\":\"AND\",\"right\":{\"left\":\"M\",\"operator\":\"AND\",\"right\":{\"left\":\"N\",\"operator\":\"AND\",\"right\":{\"left\":\"O\",\"operator\":\"AND\",\"right\":{\"left\":\"P\",\"operator\":\"AND\",\"right\":{\"left\":\"S\",\"operator\":\"AND\",\"right\":{\"left\":\"U\",\"operator\":\"AND\",\"right\":{\"left\":\"V\",\"operator\":\"AND\",\"right\":{\"left\":\"X\",\"operator\":\"AND\",\"right\":{\"left\":\"Y\",\"operator\":\"AND\",\"right\":\"Z\"}}}}}}}}}}}}}}}}}}}}}}}}},\"version\":\"v0.1\"},\"metric\":{\"mlid\":1,\"name\":\"externalconnections\",\"label\":\"External Connections\"},\"triggeredFilters\":[{\"cfid\":23426,\"id\":\"A\",\"filterType\":\"Beaconing score\",\"arguments\":{\"value\":60},\"comparatorType\":\">\",\"trigger\":{\"value\":\"100\"}},{\"cfid\":23427,\"id\":\"AA\",\"filterType\":\"Individual size up\",\"arguments\":{\"value\":0},\"comparatorType\":\">\",\"trigger\":{\"value\":\"4382\"}},{\"cfid\":23428,\"id\":\"AB\",\"filterType\":\"Rare domain\",\"arguments\":{\"value\":95},\"comparatorType\":\">\",\"trigger\":{\"value\":\"100\"}},{\"cfid\":23430,\"id\":\"AD\",\"filterType\":\"Age of destination\",\"arguments\":{\"value\":1209600},\"comparatorType\":\"<\",\"trigger\":{\"value\":\"558\"}},{\"cfid\":23431,\"id\":\"AE\",\"filterType\":\"Age of external hostname\",\"arguments\":{\"value\":1209600},\"comparatorType\":\"<\",\"trigger\":{\"value\":\"558\"}},{\"cfid\":23432,\"id\":\"AF\",\"filterType\":\"Connection hostname\",\"arguments\":{\"value\":\"examples\"},\"comparatorType\":\"does not match regular expression\",\"trigger\":{\"value\":\"example.com\"}},{\"cfid\":23433,\"id\":\"AG\",\"filterType\":\"ASN\",\"arguments\":{\"value\":\"examples\"},\"comparatorType\":\"does not match regular expression\",\"trigger\":{\"value\":\"AS12345 LOCAL-02\"}},{\"cfid\":23434,\"id\":\"AH\",\"filterType\":\"JA3 hash\",\"arguments\":{\"value\":\"5d41402abc4b2a76b9719d911017c592\"},\"comparatorType\":\"does not match\",\"trigger\":{\"value\":\"5d41402abc4b2a76b9719d911017c592\"}},{\"cfid\":23435,\"id\":\"B\",\"filterType\":\"Rare external IP\",\"arguments\":{\"value\":95},\"comparatorType\":\">\",\"trigger\":{\"value\":\"100\"}},{\"cfid\":23436,\"id\":\"C\",\"filterType\":\"Application protocol\",\"arguments\":{\"value\":\"1003\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"1004\"}},{\"cfid\":23437,\"id\":\"D\",\"filterType\":\"Destination port\",\"arguments\":{\"value\":53},\"comparatorType\":\"!=\",\"trigger\":{\"value\":\"443\"}},{\"cfid\":23438,\"id\":\"E\",\"filterType\":\"Direction\",\"arguments\":{\"value\":\"out\"},\"comparatorType\":\"is\",\"trigger\":{\"value\":\"out\"}},{\"cfid\":23439,\"id\":\"H\",\"filterType\":\"Destination port\",\"arguments\":{\"value\":137},\"comparatorType\":\"!=\",\"trigger\":{\"value\":\"443\"}},{\"cfid\":23440,\"id\":\"I\",\"filterType\":\"Destination port\",\"arguments\":{\"value\":161},\"comparatorType\":\"!=\",\"trigger\":{\"value\":\"443\"}},{\"cfid\":23441,\"id\":\"J\",\"filterType\":\"Protocol\",\"arguments\":{\"value\":\"6\"},\"comparatorType\":\"is\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23442,\"id\":\"K\",\"filterType\":\"ASN\",\"arguments\":{\"value\":\"Company\"},\"comparatorType\":\"does not contain\",\"trigger\":{\"value\":\"AS12345 LOCAL-02\"}},{\"cfid\":23443,\"id\":\"L\",\"filterType\":\"ASN\",\"arguments\":{\"value\":\"Company\"},\"comparatorType\":\"does not contain\",\"trigger\":{\"value\":\"AS12345 LOCAL-02\"}},{\"cfid\":23444,\"id\":\"M\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"13\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23445,\"id\":\"N\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"5\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23446,\"id\":\"O\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"9\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23447,\"id\":\"P\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"12\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23448,\"id\":\"S\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"30\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23449,\"id\":\"U\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"4\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23450,\"id\":\"V\",\"filterType\":\"Internal source device type\",\"arguments\":{\"value\":\"3\"},\"comparatorType\":\"is not\",\"trigger\":{\"value\":\"6\"}},{\"cfid\":23451,\"id\":\"X\",\"filterType\":\"Trusted hostname\",\"arguments\":{\"value\":\"false\"},\"comparatorType\":\"is\",\"trigger\":{\"value\":\"false\"}},{\"cfid\":23452,\"id\":\"Y\",\"filterType\":\"Tagged internal source\",\"arguments\":{\"value\":26},\"comparatorType\":\"does not have tag\",\"trigger\":{\"value\":\"26\",\"tag\":{\"tid\":26,\"expiry\":0,\"thid\":26,\"name\":\"No Device Tracking\",\"restricted\":false,\"data\":{\"auto\":false,\"color\":5,\"description\":\"\",\"visibility\":\"Public\"},\"isReferenced\":true}}},{\"cfid\":23453,\"id\":\"Z\",\"filterType\":\"Individual size down\",\"arguments\":{\"value\":0},\"comparatorType\":\">\",\"trigger\":{\"value\":\"5862\"}},{\"cfid\":23454,\"id\":\"d1\",\"filterType\":\"JA3 hash\",\"arguments\":{},\"comparatorType\":\"display\",\"trigger\":{\"value\":\"5d41402abc4b2a76b9719d911017c592\"}},{\"cfid\":23455,\"id\":\"d2\",\"filterType\":\"ASN\",\"arguments\":{},\"comparatorType\":\"display\",\"trigger\":{\"value\":\"AS12345 LOCAL-02\"}},{\"cfid\":23456,\"id\":\"d3\",\"filterType\":\"Destination IP\",\"arguments\":{},\"comparatorType\":\"display\",\"trigger\":{\"value\":\"81.2.69.192\"}},{\"cfid\":23457,\"id\":\"d4\",\"filterType\":\"Connection hostname\",\"arguments\":{},\"comparatorType\":\"display\",\"trigger\":{\"value\":\"example.com\"}}]}],\"score\":0.674,\"device\":{\"did\":3,\"ip\":\"81.2.69.142\",\"sid\":1,\"firstSeen\":1657544089000,\"lastSeen\":1657544418000,\"typename\":\"desktop\",\"typelabel\":\"Desktop\"}}",
        "risk_score": 0.674,
        "risk_score_norm": 67.4,
        "severity": 2,
        "start": [
            "2022-07-11T13:04:08.000Z"
        ],
        "type": [
            "info",
            "connection"
        ]
    },
    "host": {
        "id": "3",
        "ip": [
            "81.2.69.142"
        ],
        "type": "desktop"
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "source": {
            "address": "192.168.112.3:50896"
        },
        "syslog": {
            "facility": {
                "code": 20,
                "name": "local4"
            },
            "hostname": "example.cloud.darktrace.com",
            "priority": 165,
            "severity": {
                "code": 5,
                "name": "Notice"
            },
            "version": "1"
        }
    },
    "related": {
        "ip": [
            "81.2.69.142"
        ],
        "user": [
            "System"
        ]
    },
    "rule": {
        "author": [
            "System"
        ],
        "category": "Informational",
        "description": "A device has been repeatedly connecting to a rare external location with a beacon score. A beacon score is added when Darktrace identifies that a device is regularly communicating with an endpoint, for example, if a device connects to a rare external endpoint every 12 minutes this would get a beacon score. This model is designed to identify beaconing at a lower threshold and be protocol agnostic.\\n\\nAction: Review the external domains and IPs being connected to to see if they are legitimate and would be expected for business purposes.",
        "name": "Compromise::Beaconing Activity To External Rare",
        "ruleset": [
            "AP: C2 Comms"
        ],
        "uuid": "1234abcd-1234-1234-1234-123456abcdef",
        "version": "23"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "darktrace-model_breach_alert"
    ]
}

{
    "@timestamp": "2021-04-18T15:44:11.000Z",
    "agent": {
        "ephemeral_id": "b16aba4d-b447-49c7-ac87-7785481b8e51",
        "id": "85270a54-b915-4d11-9305-d004346cb8cf",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.9.0"
    },
    "darktrace": {
        "system_status_alert": {
            "alert_name": "Advanced Search",
            "child_id": 1,
            "hostname": "example-vsensor",
            "ip_address": "175.16.199.1",
            "last_updated": "2021-04-18T15:44:11.000Z",
            "last_updated_status": "2021-04-18T15:44:11.000Z",
            "message": "There have been no Advanced Search hits for this instance seen since Sun 18 April 2021 13:20:23 (UTC). If this is not expected behaviour, please open a ticket using the following link or get in touch with your Cyber Technology Specialist. https://example.com/test",
            "name": "advanced_search",
            "priority": 43,
            "priority_level": "medium",
            "status": "active",
            "uuid": "abcdabcd-1234-1234-1234-3abababcdcd3"
        }
    },
    "data_stream": {
        "dataset": "darktrace.system_status_alert",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "85270a54-b915-4d11-9305-d004346cb8cf",
        "snapshot": true,
        "version": "8.9.0"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "darktrace.system_status_alert",
        "id": "abcdabcd-1234-1234-1234-3abababcdcd3",
        "ingested": "2023-06-14T17:06:15Z",
        "kind": "alert",
        "original": "{\"last_updated\":1618760651,\"uuid\":\"abcdabcd-1234-1234-1234-3abababcdcd3\",\"priority\":43,\"priority_level\":\"medium\",\"hostname\":\"example-vsensor\",\"ip_address\":\"175.16.199.1\",\"message\":\"There have been no Advanced Search hits for this instance seen since Sun 18 April 2021 13:20:23 (UTC). If this is not expected behaviour, please open a ticket using the following link or get in touch with your Cyber Technology Specialist. https://example.com/test\",\"name\":\"advanced_search\",\"acknowledge_timeout\":null,\"alert_name\":\"Advanced Search\",\"child_id\":1,\"last_updated_status\":1618760651,\"status\":\"active\"}",
        "reason": "There have been no Advanced Search hits for this instance seen since Sun 18 April 2021 13:20:23 (UTC). If this is not expected behaviour, please open a ticket using the following link or get in touch with your Cyber Technology Specialist. https://example.com/test",
        "risk_score": 43,
        "risk_score_norm": 43,
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "example-vsensor",
        "ip": [
            "175.16.199.1"
        ]
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "source": {
            "address": "172.31.0.4:43852"
        },
        "syslog": {
            "facility": {
                "code": 20,
                "name": "local4"
            },
            "hostname": "example.cloud.darktrace.com",
            "priority": 165,
            "severity": {
                "code": 5,
                "name": "Notice"
            },
            "version": "1"
        }
    },
    "related": {
        "hosts": [
            "example-vsensor"
        ],
        "ip": [
            "175.16.199.1"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "darktrace-system_status_alert"
    ]
}