{
  "Event": {
    "analysis": "1",
    "date": "2026-02-15",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-02-15",
    "publish_timestamp": "1771180975",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1771180975",
    "uuid": "624a5d25-1f81-4919-b066-8ff3a71c7099",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T00:49:56.084140+00:00",
        "timestamp": "1771116597",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2b023480-afce-4ca6-b3e1-4092cd94deb6",
        "value": "2001:470:1:332::9",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T01:02:57.581313+00:00",
        "timestamp": "1771117379",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f1729bad-bf6f-480a-a22a-50705813c34e",
        "value": "167.94.138.188",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T01:03:08.426188+00:00",
        "timestamp": "1771117389",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "85f2a788-e395-4dc2-8a1d-93690e656e50",
        "value": "167.94.138.185",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T01:07:05.124747+00:00",
        "timestamp": "1771117626",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "02439e23-a069-4ad6-81fb-092c7434fd64",
        "value": "213.209.159.55",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Google Webcrawler User-Agent (Mediapartners-Google)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T02:35:49.606980+00:00",
        "timestamp": "1771122951",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "76f2ecde-4d01-4f45-ba3f-fed021304d33",
        "value": "113.165.121.239",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T04:52:41.830074+00:00",
        "timestamp": "1771131163",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1cc7b7f4-52e4-435b-9f75-6afc59df0b14",
        "value": "191.96.67.196",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T05:18:39.885536+00:00",
        "timestamp": "1771132721",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "748bd45f-baa1-44f1-acda-108f6be24502",
        "value": "2001:470:1:fb5::280",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "- i Censys - HTTP User-Agent Scanner",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T06:25:01.640109+00:00",
        "timestamp": "1771136703",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "25c485f6-ebd6-4868-8d9d-4e0b9b29bffb",
        "value": "2602:80d:1003::26",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T13:29:26.873929+00:00",
        "timestamp": "1771162168",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "9de46e84-857e-492e-976f-a32533be047b",
        "value": "43.163.104.54",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T14:10:11.340471+00:00",
        "timestamp": "1771164613",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "11e40b54-6a43-45a9-b481-5a2e754f4eec",
        "value": "45.83.28.219",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Javascript Prototype Pollution Attempt via __proto__ in HTTP Body",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T15:26:24.755923+00:00",
        "timestamp": "1771169186",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "625e3ea3-d8c7-4618-b02a-f0be6d4f4b27",
        "value": "2a02:c207:2308:2155::1",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN WordPress Scanner Performing Multiple Requests to Windows Live Writer XML",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-02-15T18:42:54.132505+00:00",
        "timestamp": "1771180975",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "33761f17-b4a4-480b-b223-6a9d6fed28b6",
        "value": "146.70.194.236",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}