{
  "Event": {
    "analysis": "1",
    "date": "2026-03-20",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-20",
    "publish_timestamp": "1774028444",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1774028429",
    "uuid": "48116205-bffa-4db1-b520-1062c73d5973",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-20T07:38:56.742901+00:00",
        "timestamp": "1773992338",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "13c5e7a4-fef0-4dd6-ad51-1ad1726b48ac",
        "value": "37.72.140.25",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-20T10:47:18.861491+00:00",
        "timestamp": "1774003640",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "619ac9f4-8571-4183-b31d-e95ba1ca1c58",
        "value": "43.155.157.239",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN FTPSync Settings Disclosure Attempt",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-20T11:08:01.700102+00:00",
        "timestamp": "1774004883",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c20e9e5c-7612-4961-9ed7-623624a937e5",
        "value": "20.17.176.208",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-20T16:16:59.258993+00:00",
        "timestamp": "1774023420",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "85dd9a80-871d-40cf-b7f1-5d5c66044701",
        "value": "211.249.46.138",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ATTACK [PTsecurity] React Server Components RCE (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-20T17:40:28.362878+00:00",
        "timestamp": "1774028429",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7285af22-97e7-4f16-a280-714c2d9c6871",
        "value": "135.225.84.187",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}