{
  "Event": {
    "analysis": "1",
    "date": "2026-04-19",
    "extends_uuid": "",
    "info": "KRVTZ-NET IDS alerts for 2026-04-19",
    "publish_timestamp": "1776636444",
    "published": true,
    "threat_level_id": "3",
    "timestamp": "1776636367",
    "uuid": "dea5f4a1-4379-490f-af54-a23635ce1fbd",
    "Orgc": {
      "name": "Krawczyk Industries Limited",
      "uuid": "593e9fc8-be28-4cb2-a79b-43f8950d210f"
    },
    "Tag": [
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#00ce5f",
        "local": false,
        "name": "misp:event-type=\"observation\"",
        "relationship_type": ""
      },
      {
        "colour": "#50003a",
        "local": false,
        "name": "kill-chain:Reconnaissance",
        "relationship_type": ""
      },
      {
        "colour": "#009042",
        "local": false,
        "name": "misp:automation-level=\"unsupervised\"",
        "relationship_type": ""
      },
      {
        "colour": "#edbfa2",
        "local": false,
        "name": "type:OSINT', 'osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T00:26:53.289978+00:00",
        "timestamp": "1776558415",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "4f359a4f-5ae1-4fc8-93b0-ca2a722da724",
        "value": "64.62.197.167",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET EXPLOIT Fortigate VPN - Repeated GET Requests to /remote/logincheck (CVE-2023-27997)",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T05:19:56.597197+00:00",
        "timestamp": "1776575998",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "cc517c34-8396-4c03-b321-bce2e04e454d",
        "value": "65.49.1.202",
        "Tag": [
          {
            "colour": "#008a3f",
            "local": false,
            "name": "misp:threat-level=\"high-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T05:34:17.651709+00:00",
        "timestamp": "1776576859",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "696b64ee-0a0c-485c-8c9e-7fce972109ad",
        "value": "34.71.208.184",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T17:09:10.175739+00:00",
        "timestamp": "1776618551",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "c32c4af2-5dc3-486a-9369-55487cc522ac",
        "value": "68.66.112.120",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T17:28:46.277769+00:00",
        "timestamp": "1776619727",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "f7a9cd32-b37b-4f2b-bff8-9be4b69ea2c0",
        "value": "2a0b:8bc0:2:9633::1",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET SCAN Suspicious User-Agent Containing Security Scan/ner Likely Scan",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T20:30:42.108276+00:00",
        "timestamp": "1776630644",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "3b4cdb2d-7da4-4c22-a978-2f2d26390100",
        "value": "103.168.66.237",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T22:00:24.804393+00:00",
        "timestamp": "1776636030",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "7b1ed0e3-731c-451b-b637-ff40ffe59bf7",
        "value": "136.119.219.32",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Network activity",
        "comment": "ET INFO Request to Hidden Environment File - Inbound",
        "deleted": false,
        "disable_correlation": false,
        "last_seen": "2026-04-19T22:06:06.156931+00:00",
        "timestamp": "1776636367",
        "to_ids": true,
        "type": "ip-src",
        "uuid": "0d0365ee-38ff-496e-9efb-57f9a77d5102",
        "value": "103.215.74.185",
        "Tag": [
          {
            "colour": "#00833c",
            "local": false,
            "name": "misp:threat-level=\"medium-risk\"",
            "relationship_type": ""
          },
          {
            "colour": "#a80079",
            "local": false,
            "name": "kill-chain:Exploitation",
            "relationship_type": ""
          }
        ]
      }
    ]
  }
}