{
  "Event": {
    "analysis": "1",
    "date": "2026-04-27",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-27",
    "publish_timestamp": "1777321551",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1777321455",
    "uuid": "3c8177db-2006-4a46-82a4-2653c6a866b7",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T05:26:35.630820+00:00",
        "timestamp": "1777267597",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bfd0051a-267e-438a-8981-ae9be9cf5696",
        "value": "195.178.110.101",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T06:11:51.812769+00:00",
        "timestamp": "1777270313",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "fb0aaba3-67fd-40c1-b605-702984e5b997",
        "value": "2a03:4000:1c:31b:b474:69ff:fea2:69eb",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN SFTP/FTP Password Exposure via sftp-config.json",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T09:53:58.559479+00:00",
        "timestamp": "1777283640",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "bd645d43-11da-4837-8485-7efaa74e5d4e",
        "value": "45.201.143.113",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T11:25:06.354950+00:00",
        "timestamp": "1777289108",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2f9ea90b-8ad5-4169-8c49-cd18d0d8b202",
        "value": "146.235.18.205",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T13:10:25.151856+00:00",
        "timestamp": "1777295426",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f5e719d5-cc7e-4a43-b4e9-e0bc1f3bcebc",
        "value": "34.45.64.62",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T15:02:09.494995+00:00",
        "timestamp": "1777302131",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0ad37271-5e2e-4c69-9bb2-bf6f6d95c06c",
        "value": "154.29.87.105",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Exabot Webcrawler User Agent",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T15:05:30.930890+00:00",
        "timestamp": "1777302332",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "55293045-664f-46a8-a197-4b9382d6d23c",
        "value": "107.173.36.87",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Spring Boot Actuator Health Check Request",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-27T20:24:13.773261+00:00",
        "timestamp": "1777321455",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f95a4859-996e-492d-8d42-601c1706c31a",
        "value": "45.88.138.44",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}