{
  "Event": {
    "analysis": "1",
    "date": "2026-04-08",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-08",
    "publish_timestamp": "1775661402",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1775661402",
    "uuid": "d4f73963-1064-40a8-ba8d-b64f253d0f5f",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T01:04:22.798784+00:00",
        "timestamp": "1775610264",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "d53961e5-8ffc-407b-9029-2a9c4c07289a",
        "value": "84.54.33.197",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T01:31:11.797109+00:00",
        "timestamp": "1775611874",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "2e05c8a5-a6bd-4d3d-ba00-0f6a869cc68f",
        "value": "158.94.209.109",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET HUNTING Suspicious User-Agent Observed (Mozilla/5.0 (Windows NT XX.X Win64 x64) AppleWebKit/XXX.XX)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T04:28:47.308934+00:00",
        "timestamp": "1775622529",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "1f9634b9-2e32-4ab9-8e0a-f27c4796b614",
        "value": "198.98.50.128",
        "Tag": [
          {
            "colour": "#007d3a",
            "local": false,
            "name": "misp:threat-level=\"low-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#50003a",
            "local": false,
            "name": "kill-chain:Reconnaissance",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T05:24:42.868708+00:00",
        "timestamp": "1775625885",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "afa06ab4-c654-44cb-a4f1-4439c3cff6ea",
        "value": "216.173.113.3",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T07:17:18.757551+00:00",
        "timestamp": "1775632641",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3412956a-ed7a-4faa-b429-d017e5e094c1",
        "value": "2001:470:1:fb5::1e0",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T07:17:43.109049+00:00",
        "timestamp": "1775632665",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "59cac480-8d74-44b6-abf4-11f8929399c5",
        "value": "2001:470:1:fb5:f608:8a5d:c2c4:780c",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "Web shell hunting (banned): /.well-known/index.php",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T08:51:23.970860+00:00",
        "timestamp": "1775638285",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "a8984f18-8e63-4677-9926-b7277746a71e",
        "value": "20.104.201.101",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-08T15:16:40.462246+00:00",
        "timestamp": "1775661402",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0861f87f-d6b3-47ba-af7b-f7962794e9f3",
        "value": "74.234.35.227",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}