The first example tries to follow the same coloring scheme and distinction as in the schema definition
Example 1 with color distinction
{
"Device": {
"vendor": "Cisco",
"product": "ASA",
"version": "5525-X",
"OS": "IOS 14",
"module": "Firepower",
"feature": "WEB
protection",
"device_name":
"badassfw",
"device_IP":
"10.20.255.1",
"policy": "block_porn",
"rule": "24",
"action": "blocked",
},
"Priority": {
"severity": "High",
"credibility": "Med",
"relevance": "10",
},
"Alert": {
"time": "2019/06/05
13:02:14.171",
"category":
["WEB","Traffic blocked","web access blocked"],
"name": "Porn site
access",
"id": "100237"
"link": "http://10.20.255.1/alerts?id=100237"
"domain": "Tenant1",
"region": "CZ",
"target":
["freevideo.cz","adm_user","10.101.24.23"],
"artifacts": {
"username":
"adm_user",
"src_IP":
"10.101.24.23",
"src_port": "50435",
"dst_IP":
"80.188.244.72",
"dst_port": "443",
"domain":
"freevideo.cz",
"url":
"https://freevideo.cz/big_gang_bang_theory",
},
"status": "active",
"tactics": ["defense evasion","execution"],
"techniques": "Web service"
"rawData": "null",
"associated_events": [
{
"time":"2019/06/05
13:02:11.171",
"name":"blocked web
traffic",
"target":["freevideo.cz"],
"artifacts": {
"username":
"adm_user",
"src_IP":
"10.101.24.23",
"src_port": "50435",
"dst_IP":
"80.188.244.72",
"dst_port":
"80",
"domain":
"freevideo.cz",
"url":
"freevideo.cz",
},
"count": 1,
"rawData":
"empty"
},
{
"time":"2019/06/05
13:02:12.171",
"name":"blocked web
traffic",
"target":["https://freevideo.cz"],
"artifacts": {
"username":
"adm_user",
"src_IP":
"10.101.24.23",
"src_port": "50435",
"dst_IP":
"80.188.244.72",
"dst_port":
"443",
"domain":
"freevideo.cz",
"url":
"https://freevideo.cz/",
},
"count": 1,
"rawData":
"empty"},
{
"time":"2019/06/05
13:02:13.171",
"name":"blocked web
traffic",
"target":["https://freevideo.cz/big_gang_bankg_theory"],
"artifacts": {
"username":
"adm_user",
"src_IP":
"10.101.24.23",
"src_port":
"50435",
"dst_IP":
"80.188.244.72",
"dst_port":
"443",
"domain":
"freevideo.cz",
"url":
"https://freevideo.cz/big_gang_bang_theory",
},
"count": 1,
"rawData":
"empty"},
]
}
}
Example 2
{
"Device": {
"product": "AuditVault",
"device_name": "oracleauditvault",
"device_IP": "10.20.25.101",
"policy": "select star",
"action": "alert",
},
"Priority": {
"severity": "Medium",
},
"Alert": {
"time": "2020/02/02 10:22:14.153",
"category": ["DB","access","select"],
"name": "select star",
"target": ["etl_live","sysdba","10.10.24.23"],
"artifacts": {
"username": "sysdba",
"src_IP": "10.10.24.23",
"src_port": "56449",
"dst_IP": "10.18.24.72",
"dst_port": "1514",
"database": "etl_live",
"table": "users",
},
"rawData": "select * from users;",
}
}
