{
  "Event": {
    "analysis": "1",
    "date": "2026-03-22",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-22",
    "publish_timestamp": "1774192489",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1774192488",
    "uuid": "c363da9b-daf2-4390-9810-f1ae58ba170b",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "haproxy: 160.119.76.59 connecting to (submission/TCP) 15x in hour, possible bruteforcing.",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T02:28:28.373871+00:00",
        "timestamp": "1774146510",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "6ce6aad5-5817-4bc1-a72b-f822cd9dc419",
        "value": "160.119.76.59",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T06:43:11.250849+00:00",
        "timestamp": "1774161793",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a2ab5d0f-e471-40ef-b0c5-918442dbe8ef",
        "value": "2001:470:1:fb5::2a0",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T06:45:39.001570+00:00",
        "timestamp": "1774161940",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "68a6e8eb-0b71-4c41-bf39-ca628a033374",
        "value": "87.228.89.252",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T08:17:51.215267+00:00",
        "timestamp": "1774167472",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a7d4353f-6681-43bd-96d6-d7052e9d0f23",
        "value": "20.151.11.236",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T13:32:57.707731+00:00",
        "timestamp": "1774186379",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f8c240a9-3f28-425e-be5a-b9594681cbf9",
        "value": "23.101.8.77",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SPECIFIC_APPS Joolma Simple File Upload Plugin Remote Code Execution (CVE-2011-5148)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-22T15:14:47.174761+00:00",
        "timestamp": "1774192488",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4b6f9b4b-167c-4ac8-9796-e5827994d489",
        "value": "20.200.222.0",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}