Azure-Sentinel/Sample Data/AIA-Darktrace.csv

1	DeviceEventClassID	LogSeverity	OriginalLogSeverity	DeviceAction	SimplifiedDeviceAction	Computer	CommunicationDirection	DeviceFacility	DestinationPort	DestinationIP	DeviceAddress	DeviceName	Message	Protocol	SourcePort	SourceIP	RemoteIP	RemotePort	MaliciousIP	ThreatSeverity	IndicatorThreatType	ThreatDescription	ThreatConfidence	ReportReferenceLink	MaliciousIPLongitude	MaliciousIPLatitude	MaliciousIPCountry	DeviceVersion	Activity	ApplicationProtocol	EventCount	DestinationDnsDomain	DestinationServiceName	DestinationTranslatedAddress	DestinationTranslatedPort	DeviceDnsDomain	DeviceExternalID	DeviceInboundInterface	DeviceNtDomain	DeviceOutboundInterface	DevicePayloadId	ProcessName	DeviceTranslatedAddress	DestinationHostName	DestinationMACAddress	DestinationNTDomain	DestinationProcessId	DestinationUserPrivileges	DestinationProcessName	DeviceTimeZone	DestinationUserID	DestinationUserName	DeviceMacAddress	ProcessID	ExternalID	FileCreateTime	FileHash	FileID	FileModificationTime	FilePath	FilePermission	FileType	FileName	FileSize	ReceivedBytes	OldFileCreateTime	OldFileHash	OldFileID	OldFileModificationTime	OldFileName	OldFilePath	OldFilePermission	OldFileSize	OldFileType	SentBytes	RequestURL	RequestClientApplication	RequestContext	RequestCookies	RequestMethod	SourceHostName	SourceMACAddress	SourceNTDomain	SourceDnsDomain	SourceServiceName	SourceTranslatedAddress	SourceTranslatedPort	SourceProcessId	SourceUserPrivileges	SourceProcessName	SourceUserID	SourceUserName	EventType	DeviceCustomIPv6Address1	DeviceCustomIPv6Address1Label	DeviceCustomIPv6Address2	DeviceCustomIPv6Address2Label	DeviceCustomIPv6Address3	DeviceCustomIPv6Address3Label	DeviceCustomIPv6Address4	DeviceCustomIPv6Address4Label	DeviceCustomFloatingPoint1	DeviceCustomFloatingPoint1Label	DeviceCustomFloatingPoint2	DeviceCustomFloatingPoint2Label	DeviceCustomFloatingPoint3	DeviceCustomFloatingPoint3Label	DeviceCustomFloatingPoint4	DeviceCustomFloatingPoint4Label	DeviceCustomNumber1	DeviceCustomNumber1Label	DeviceCustomNumber2	DeviceCustomNumber2Label	DeviceCustomNumber3	DeviceCustomNumber3Label	DeviceCustomString1	DeviceCustomString1Label	DeviceCustomString2	DeviceCustomString2Label	DeviceCustomString3	DeviceCustomString3Label	DeviceCustomString4	DeviceCustomString4Label	DeviceCustomString5	DeviceCustomString5Label	DeviceCustomString6	DeviceCustomString6Label	DeviceCustomDate1	DeviceCustomDate1Label	DeviceCustomDate2	DeviceCustomDate2Label	FlexDate1	FlexDate1Label	FlexNumber1	FlexNumber1Label	FlexNumber2	FlexNumber2Label	FlexString1	FlexString1Label	FlexString2	FlexString2Label	AdditionalExtensions	StartTime [UTC]	EndTime [UTC]	Type	_ResourceId
2	26	7							443	127.0. 0.1	127.0. 0.1	deviceNameExample.com																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1907243																																																																																							message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://sample/mb/1907243			CommonSecurityLog
3	26	7							443	127.0. 0.1	10.12.13.14																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External															slammar.iotrap.com											1907242																																																																																							message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://sample/mb/1907242			CommonSecurityLog
4	17	6							445	127.0. 0.1.22	10.20.15.10																	4.1	Anomalous Server Activity/Anomalous External Activity from Critical Network Device																										1907249																																																																																							darktraceUrl=https://sample/mb/1907249			CommonSecurityLog
5	26	8							3389	127.0. 0.1.11	10.40.30.20																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External															s1-ip6da	00:15:5d:24:03:4a										1900990																																																																																							message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://sample/mb/1900990			CommonSecurityLog
6	26	8							3389	127.0. 0.1.11	127.0. 0.1.11	s1-ip6da																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																00:15:5d:24:03:4a										1900991																																																																																							deviceMacAddress=00:15:5d:24:03:4a;message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://sample/mb/1900991			CommonSecurityLog
7	17	6							445	127.0. 0.1.22	10.20.15.10																	4.1	Anomalous Server Activity/Anomalous External Activity from Critical Network Device																										1900999																																																																																							darktraceUrl=https://sample/mb/1900999			CommonSecurityLog
8	26	8							443	52.112.212.77	10.180.18.1	username-XPS-13-9350																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1874731																																																																																							deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://sample/mb/1874731			CommonSecurityLog
9	26	8							3389	10.180.80.45	10.180.1.18																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1875106																																																																																							message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://sample/mb/1875106			CommonSecurityLog
10	26	8							3389	10.180.80.45	10.180.80.45																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1875108																																																																																							message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://sample/mb/1875108			CommonSecurityLog
11	26	8							443	152.179.58.165	10.161.1.2	C02Z85AYLVDC																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1875226																																																																																							deviceMacAddress=a4:83:e7:9d:c1:f9;darktraceUrl=https://sample/mb/1875226			CommonSecurityLog
12	26	8							5229	27.220.55.34	112.24.71.20	Galaxy-S6																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1875651																																																																																							deviceMacAddress=00:ae:fa:65:f4:24;darktraceUrl=https://sample/mb/1875651			CommonSecurityLog
13	26	8							443	217.41.245.117	112.24.71.170	LA-365																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1872713																																																																																							deviceMacAddress=f8:ff:c2:04:f8:6a;message=. . SSL certificate validation failed with (unable to get local issuer certificate);darktraceUrl=https://sample/mb/1872713			CommonSecurityLog
14	26	8							443	187.167.182.111	10.20.30.4																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1874089																																																																																							message=. . SSL certificate validation failed with (self signed certificate);darktraceUrl=https://sample/mb/1874089			CommonSecurityLog
15	26	8							443	187.167.182.111	187.167.182.111																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1874090																																																																																							message=. . SSL certificate validation failed with (self signed certificate);darktraceUrl=https://sample/mb/1874090			CommonSecurityLog
16	390	6								14.74.114.220	14.74.114.220																	4.1	User/Unusual External Source for Credential Use																										1893897																																																																																							message=. . Unusual source for use of example@sample.com from AS2905 TICSA-ASN. example@sample.com;darktraceUrl=https://sample/mb/1893897			CommonSecurityLog
17	349	7									0.0.0.0																	4.1	System/System																										1870730																																																																																							message=. . Probe error;darktraceUrl=https://sample/mb/1870730			CommonSecurityLog
18	26	7							443	201.67.185.30	10.180.18.1	username-XPS-13-9350																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1878552																																																																																							deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://sample/mb/1878552			CommonSecurityLog
19	26	6							443	201.67.180.22	10.110.10.8	FFMZJD0SJC67																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1878553																																																																																							deviceMacAddress=56:fb:e2:58:37:4a;darktraceUrl=https://sample/mb/1878553			CommonSecurityLog
20	465	6							443	14.74.114.220	14.74.114.11																	4.1	Antigena/Network/External Threat/Antigena Quarantine Example test client																										1837581																																																																																							darktraceUrl=https://sample/mb/1837581			CommonSecurityLog
21	26	6							443	14.74.114.220	14.74.114.2	username-XPS-13-9350																4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1898432																																																																																							deviceMacAddress=c8:ff:28:b6:2c:d7;darktraceUrl=https://sample/mb/1898432			CommonSecurityLog
22	17	6							445	127.0. 0.1.22	10.180.80.54																	4.1	Anomalous Server Activity/Anomalous External Activity from Critical Network Device																										1909925																																																																																							darktraceUrl=https://sample/mb/1909925			CommonSecurityLog
23	26	7							3389	254.169.184.82	10.30.40.20																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1902616																																																																																							message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://sample/mb/1902616			CommonSecurityLog
24	26	8							3389	254.169.184.82	254.169.184.82																	4.1	Anomalous Connection/Anomalous SSL without SNI to New External																										1902617																																																																																							message=. . SSL certificate seen younger than 30.0 days;darktraceUrl=https://sample/mb/1902617			CommonSecurityLog
25	465	5							443	14.74.114.220	120.239.186.158																	4.1	Antigena/Network/External Threat/Antigena Quarantine Example test client															motd.ubuntu.com											1902823																																																																																							darktraceUrl=https://sample/mb/1902823			CommonSecurityLog