{
  "Event": {
    "analysis": "1",
    "date": "2026-03-29",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-29",
    "publish_timestamp": "1774819754",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1774819754",
    "uuid": "52b2eb89-f08a-4dc8-8993-ef4042e00add",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T00:03:54.503890+00:00",
        "timestamp": "1774742636",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ae089883-9e42-4030-9a2f-3dd3014d9e77",
        "value": "216.106.187.83",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T00:43:58.171568+00:00",
        "timestamp": "1774745039",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "300de208-95fd-4756-952a-5a595b277895",
        "value": "209.97.162.99",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET MALWARE Observed Coruna User-Agent (Outbound)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T09:13:09.175463+00:00",
        "timestamp": "1774775590",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3c46b581-d4cd-420d-895e-af65e231f703",
        "value": "2402:9d80:3b2:5922:e5b5:b4bf:cc8:bf7f",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T12:38:13.744300+00:00",
        "timestamp": "1774787895",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a084b556-b849-4ce5-88cb-8c58fefbf620",
        "value": "34.29.94.142",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T16:46:15.893665+00:00",
        "timestamp": "1774802777",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "38fa7eec-51d1-48e1-a306-6f73504a1012",
        "value": "35.223.101.188",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T17:21:35.035817+00:00",
        "timestamp": "1774804896",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e195ad93-0fe8-4b3d-9db5-5616c454e4ff",
        "value": "125.209.235.185",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T17:21:42.472554+00:00",
        "timestamp": "1774804903",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1664fce6-00ae-42f5-9507-f372eaa070cf",
        "value": "110.93.150.128",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T17:21:47.150398+00:00",
        "timestamp": "1774804908",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "e7ddea9c-cb59-4fc9-a75c-431518d7b476",
        "value": "114.111.32.68",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T17:45:34.207092+00:00",
        "timestamp": "1774806335",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "94fdcd1c-471d-4e3a-9690-f2d5607caf25",
        "value": "20.82.99.253",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T18:51:49.958378+00:00",
        "timestamp": "1774810311",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9e23d923-84c0-477b-8b72-e7dc1a0d8ba7",
        "value": "43.153.96.233",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T19:02:32.920460+00:00",
        "timestamp": "1774810954",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "ca2d5bec-4fd9-4f24-a0b5-bbad4598796b",
        "value": "43.130.57.46",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Naver Webcrawler User-Agent (Naver.me)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-29T21:29:12.674222+00:00",
        "timestamp": "1774819754",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "76cdcf5e-3730-4ce1-be29-c11106b25e3e",
        "value": "125.209.235.182",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}