{
  "Event": {
    "analysis": "1",
    "date": "2026-03-15",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-03-15",
    "publish_timestamp": "1773615049",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1773615049",
    "uuid": "ce16d00f-4641-4e62-a2ec-e3758563d0d8",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T00:15:49.565139+00:00",
        "timestamp": "1773533752",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8c544452-cb24-450a-ad57-99a11fbf6075",
        "value": "41.143.48.201",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "TGI HUNT gitrepo HTTP Probe",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T03:30:33.446363+00:00",
        "timestamp": "1773545435",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a01bb78d-f663-45aa-a4bb-4b7a8cf5941e",
        "value": "192.253.248.12",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET WEB_SERVER WEB-PHP phpinfo access",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T05:34:52.714707+00:00",
        "timestamp": "1773552894",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "b5634df4-fba9-41a9-815e-3a6c685859b4",
        "value": "45.148.10.231",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T05:38:14.738783+00:00",
        "timestamp": "1773553096",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0d6107a3-049d-47ef-bc9f-47545d01a72c",
        "value": "2001:470:2cc:1::1df",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET USER_AGENTS User-Agent (_TEST_)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T09:24:51.534892+00:00",
        "timestamp": "1773566693",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8294b7e9-f89e-4f45-81ed-5953df428334",
        "value": "43.130.131.18",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ATTACK [PTsecurity] React Server Components RCE (CVE-2025-55182)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T12:42:43.962467+00:00",
        "timestamp": "1773578565",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7154d520-7c39-48ce-82ac-dc90c27cd418",
        "value": "2a04:9740:47:df00:fc6f:903d:4c73:6da1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Laravel Debug Mode Information Disclosure Probe Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-03-15T22:50:47.764282+00:00",
        "timestamp": "1773615049",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "8c040466-b99a-4649-8d83-adef64ae2da5",
        "value": "194.26.192.20",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}