{
  "Event": {
    "analysis": "0",
    "date": "2025-11-26",
    "extends_uuid": "",
    "info": "Salesforce Gainsight Security Advisory - Nov 2025",
    "publish_timestamp": "1764369095",
    "published": true,
    "threat_level_id": "4",
    "timestamp": "1764261431",
    "uuid": "fca42bfe-983a-4442-bfb5-5190de9bab09",
    "Orgc": {
      "name": "Ransom-ISAC",
      "uuid": "36896069-60d2-49af-b5b2-56ce09b5f70d"
    },
    "Tag": [
      {
        "colour": "#109a42",
        "local": true,
        "name": "recorded-future:threat-actor=Scattered LAPSUS$ Hunters",
        "relationship_type": ""
      },
      {
        "colour": "#ffd890",
        "local": false,
        "name": " Ransomware",
        "relationship_type": ""
      },
      {
        "colour": "#ff0000",
        "local": false,
        "name": "Scattered Spider",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Active Scanning - T1595\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1527\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Valid Accounts - T1078\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:ransomware=\"scattered lapsus$ hunters\"",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#0071c3",
        "local": false,
        "name": "osint:lifetime=\"perpetual\"",
        "relationship_type": ""
      },
      {
        "colour": "#0087e8",
        "local": false,
        "name": "osint:certainty=\"50\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:white",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "e02b4f6c-7e3a-4e1d-acdc-ce885ccf4ca7",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "db05186a-3ad5-465e-9b97-deade5dfc446",
            "value": "104.3.11.1"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "d34b1b83-f0a2-48f6-8eda-ad67232fefb0",
            "value": "AT&T IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "a5d06b50-e4d1-4968-9b0b-64e47c690e60",
            "value": "2025-11-08T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "12ecb06f-9880-4b06-928f-84ac99eba3fc",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "436ff244-3502-4930-b651-25f7be759153",
            "value": "198.54.135.148"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "81beb75f-5289-49fe-9954-49bdd4958ac6",
            "value": "Mullvad VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "916e547d-8483-436d-a541-19fc4b40c204",
            "value": "2025-11-16T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "cc55861f-8d14-45a2-9781-146493d7b26b",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "d61994ed-afea-480d-8c01-a076db4987ec",
            "value": "198.54.135.197"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "e18ffc53-c58f-4bb6-a887-af6aceb4b86a",
            "value": "Mullvad VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "92cae608-287a-4237-a208-20ebd2ec44af",
            "value": "2025-11-16T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "ecad055a-82ee-497c-9317-5e540fe0c447",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "959a3bcf-36e5-4a23-b144-34f59ce3dfc7",
            "value": "198.54.135.205"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "d74dc283-d302-4ef3-ad6f-a3f4ab9e5dc6",
            "value": "Mullvad VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "00188f0a-99d1-406c-b5a5-b49d45e44226",
            "value": "2025-11-18T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "bdced1ed-c860-4a66-8ff9-caf068670792",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "fe86b13e-66ac-4e01-91ad-281d1051ca41",
            "value": "146.70.171.216"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "5f0ae80f-1335-4d28-a4fa-c728365d236f",
            "value": "Mullvad VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d7853260-925c-411e-b7fe-2ba8624a58ba",
            "value": "2025-11-18T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "be003f42-ac17-4487-8191-f67dd4d2fabb",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "cf457861-f54b-4e6b-95e4-cbfef5cdb174",
            "value": "169.150.203.245"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "8e82ca32-d2d4-4c76-93cb-66c2109cbf1a",
            "value": "Surfshark VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "31bf33af-be36-45cf-89e7-b6d66d6df887",
            "value": "2025-11-18T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "64cf9b85-3b76-48e6-8953-99418f90d8b7",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "15dd3fc6-9be3-4d2e-8557-a7da1a6b554e",
            "value": "172.113.237.48"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "92bd7e40-eda8-48f9-9c9c-ba82407c8460",
            "value": "NSocks VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "00b79500-e064-44d2-bf0b-5b6912ca600c",
            "value": "2025-11-18T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "d3718ea2-2fda-405e-8ddb-8ddfdde4276f",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "15cbccfc-32a7-42e2-bc4f-7433a8f64744",
            "value": "45.149.173.227"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "64d130da-72b6-47a8-8734-071312d69ca7",
            "value": "Surfshark VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "8685957d-8b10-4433-bfd3-439657727088",
            "value": "2025-11-18T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "7412e9d7-8b6e-422d-9df3-0f1beaba7836",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "01ab0008-2454-49a9-865e-8ccf28cedce1",
            "value": "135.134.96.76"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "268cb2da-338b-41c6-9ef3-c122f28f5900",
            "value": "IProxyShop VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "d429c86d-0936-4a7c-a036-ffd02d04e184",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "917f2402-1c7f-4254-98ff-19dd04c6a8fe",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "5a182c3c-e88a-4df8-8188-9e6f8cbf1dd2",
            "value": "65.195.111.21"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "d6de10dd-50c5-45cc-9545-72de882e0f9c",
            "value": "IProxyShop VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "0becb94d-96a2-4ab6-ba5e-84463ed370ca",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "c8ea31f0-e309-466a-b950-a0622e803fed",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "452cb392-aa13-4e1b-8269-13c1ca101d41",
            "value": "65.195.105.81"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "0b9964a2-1a34-4298-b0c2-f55186737aff",
            "value": "Nexx VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "1b0463b3-b7ec-47ea-9982-2dc5bd4e19cb",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "4d0a3d6c-79b2-4283-b4d5-52f3c8123cfb",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "4e0e069d-ff3b-481e-9aeb-f06f99de605f",
            "value": "65.195.105.153"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "903dd661-3d87-4f74-9fe6-f31be75aa4bf",
            "value": "ProxySeller VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "f2dd2777-56a3-474e-bb3f-512531239f54",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "69ceecc9-28af-4beb-9eec-a724e0e7bea0",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "38443855-bea4-42d3-94c4-cfbcbe590dd9",
            "value": "45.66.35.35"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "92e36c2d-af3e-494d-ba9f-a3841b504d09",
            "value": "Tor VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "ca7ddb9a-32fb-4faa-be00-64c28080783a",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "db32ad09-9926-450c-adf5-1ab30f9b35fc",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "3469b58e-47fc-4315-8041-677f4deaac08",
            "value": "146.70.174.69"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "a2da0f30-8b2a-4260-b44f-eaeb7c0c45f8",
            "value": "Proton VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "e06fb254-df34-4a1f-b34c-7fe3b621df2c",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "1bfcdcb1-d344-4b1e-a1b4-a166cfb51f8a",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "fea63c36-3bf9-4956-a2fd-17ead02fe83d",
            "value": "82.163.174.83"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "4b0acfe8-c59d-4395-b878-34c8d0958025",
            "value": "ProxySeller VPN proxy IP; reconnaissance and unauthorized access."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "796ccd5c-3792-43ac-b584-e4087d0bf203",
            "value": "2025-11-19T00:00:00+00:00"
          }
        ]
      },
      {
        "comment": "",
        "deleted": false,
        "description": "An IP address (or domain or hostname) and a port seen as a tuple (or as a triple) in a specific time frame.",
        "meta-category": "network",
        "name": "ip-port",
        "template_uuid": "9f8cea74-16fe-4968-a2b4-026676949ac6",
        "template_version": "9",
        "timestamp": "1764171057",
        "uuid": "8af01f40-a42e-49d6-b91d-2a9e730895c9",
        "Attribute": [
          {
            "category": "Network activity",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ip",
            "timestamp": "1764171057",
            "to_ids": true,
            "type": "ip-dst",
            "uuid": "15308538-0519-4256-bb84-73e25f0a65e8",
            "value": "3.239.45.43"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "text",
            "uuid": "48ff30c3-ff7f-45f8-baf1-088a26d4e006",
            "value": "AWS IP; reconnaissance against customers with compromised Gainsight access token."
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "first-seen",
            "timestamp": "1764171057",
            "to_ids": false,
            "type": "datetime",
            "uuid": "704d984c-f20d-4ec5-8711-6961afc330d7",
            "value": "2025-10-23T00:00:00+00:00"
          }
        ]
      }
    ],
    "EventReport": [
      {
        "name": "Report from - https://help.salesforce.com/s/articleView?id=005229029&type=1 (1764171158)",
        "content": "Loading\n\n\u00d7Sorry to interrupt\n\nCSS Error\n\nRefresh",
        "id": "2042",
        "event_id": "379601",
        "timestamp": "1764171158",
        "uuid": "9d7843cd-bc66-44ab-a94f-45ada1942f79",
        "deleted": false
      }
    ]
  }
}