{
  "Event": {
    "analysis": "1",
    "date": "2026-03-18",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-18",
    "publish_timestamp": "1773875425",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1773875425",
    "uuid": "21c6f416-d1c2-4a84-8ebb-c189b4bf5c5d",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T04:26:08.617718+00:00",
        "timestamp": "1773807970",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "698c8a6f-3dc2-49c9-a0a9-b2d8e130ee2c",
        "value": "2001:470:1:c84::17",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T06:18:13.402062+00:00",
        "timestamp": "1773814694",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1e6f5eb0-4527-461e-b342-fba5dcb77c62",
        "value": "103.216.51.246",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T07:22:34.027202+00:00",
        "timestamp": "1773818555",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a6e0fca5-22d4-4f7e-a4c4-44ad28b54c2b",
        "value": "125.209.235.172",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T07:22:40.862510+00:00",
        "timestamp": "1773818562",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "acb7dc4a-2af2-4e5f-8b7c-1d9dbf594430",
        "value": "110.93.150.70",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T11:14:31.715173+00:00",
        "timestamp": "1773832473",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "81b621b5-0487-4dd5-91ec-a8dc089fab08",
        "value": "2a14:7c1:400::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T12:46:47.647063+00:00",
        "timestamp": "1773838009",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "676b2dad-c3d2-465f-b1e2-7828e3a90d5a",
        "value": "79.127.164.155",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T19:52:14.892295+00:00",
        "timestamp": "1773863536",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c7c20b30-7d16-4759-8cc8-b28b95969d66",
        "value": "101.99.91.139",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-18T23:10:23.916867+00:00",
        "timestamp": "1773875425",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6d91bb96-9f15-4096-8b27-5aad802fe372",
        "value": "194.156.79.94",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}