Nodes (339)
Edges (890)
| Kind | Label | ID |
|---|---|---|
| flow | flow:f25397a8d5d5 | flow:f25397a8d5d5 |
| flow | flow:478de54cd94a | flow:478de54cd94a |
| host | 104.18.39.21 | host:104.18.39.21 |
| session | SESSION-e53f703ab7b48a77 | SESSION-e53f703ab7b48a77 |
| session | SESSION-83d0b20751c23f69 | SESSION-83d0b20751c23f69 |
| protocol_event | pe:dns:SESSION-58f9cafe500f64ad | pe:dns:SESSION-58f9cafe500f6 |
| session | SESSION-9dab8edd40d14d9d | SESSION-9dab8edd40d14d9d |
| host | 52.182.143.215 | host:52.182.143.215 |
| protocol_event | pe:tls:SESSION-b7d90a2138968fa3 | pe:tls:SESSION-b7d90a2138968 |
| protocol_event | pe:tls:SESSION-de97a19f0937505c | pe:tls:SESSION-de97a19f09375 |
| protocol_event | pe:tls:SESSION-e53f703ab7b48a77 | pe:tls:SESSION-e53f703ab7b48 |
| host | 104.18.23.222 | host:104.18.23.222 |
| flow | flow:abe950115ba3 | flow:abe950115ba3 |
| host | 52.110.6.13 | host:52.110.6.13 |
| asn | asn:54113 | asn:54113 |
| protocol_event | pe:tls:SESSION-5673cdc8e15ecc28 | pe:tls:SESSION-5673cdc8e15ec |
| protocol_event | pe:tls:SESSION-05305b96b26cdffd | pe:tls:SESSION-05305b96b26cd |
| protocol_event | pe:tls:SESSION-787a71cfd2c6f769 | pe:tls:SESSION-787a71cfd2c6f |
| port_hub | 5351 | port:udp:5351 |
| flow | flow:9d482c927ad5 | flow:9d482c927ad5 |
| protocol_event | pe:tls:SESSION-e565a4fbf5cff09b | pe:tls:SESSION-e565a4fbf5cff |
| flow | flow:027ad06c15d5 | flow:027ad06c15d5 |
| session | SESSION-e6729d0ebc579395 | SESSION-e6729d0ebc579395 |
| session | SESSION-2014bf32e6dab59e | SESSION-2014bf32e6dab59e |
| flow | flow:e36e1209129d | flow:e36e1209129d |
| flow | flow:c65476284ea0 | flow:c65476284ea0 |
| protocol_event | pe:tls:SESSION-934baa2aae663ceb | pe:tls:SESSION-934baa2aae663 |
| flow | flow:189be888c3af | flow:189be888c3af |
| port_hub | 61509 | port:tcp:61509 |
| session | SESSION-200a1edeb5081c1b | SESSION-200a1edeb5081c1b |
| host | 104.18.1.62 | host:104.18.1.62 |
| protocol_event | pe:tls:SESSION-cbcc97483386b4f3 | pe:tls:SESSION-cbcc97483386b |
| flow | flow:bab9257727f6 | flow:bab9257727f6 |
| flow | flow:b41e05b0f148 | flow:b41e05b0f148 |
| host | 192.168.1.165 | host:192.168.1.165 |
| flow | flow:f6fc82e11042 | flow:f6fc82e11042 |
| protocol_event | pe:tls:SESSION-c8f5f362e7c0c5c8 | pe:tls:SESSION-c8f5f362e7c0c |
| dns_name | dns:wpad.mynetworksettings.com | dns:wpad.mynetworksettings.c |
| flow | flow:660ca437efa1 | flow:660ca437efa1 |
| geo_point | geo_34.05440_-118.24400 | geo_34.05440_-118.24400 |
| session | SESSION-604f49b2ccac8492 | SESSION-604f49b2ccac8492 |
| session | SESSION-5419af02605f5da4 | SESSION-5419af02605f5da4 |
| protocol_event | pe:tls:SESSION-2014bf32e6dab59e | pe:tls:SESSION-2014bf32e6dab |
| session | SESSION-741380b5a9a3a6c7 | SESSION-741380b5a9a3a6c7 |
| port_hub | 3478 | port:udp:3478 |
| session | SESSION-184b3698d564c9c7 | SESSION-184b3698d564c9c7 |
| protocol_event | pe:tls:SESSION-99947e3aab494326 | pe:tls:SESSION-99947e3aab494 |
| asn | asn:24940 | asn:24940 |
| protocol_event | pe:tls:SESSION-055fd962754012c2 | pe:tls:SESSION-055fd96275401 |
| protocol_event | pe:tls:SESSION-9c845bfb2b534b59 | pe:tls:SESSION-9c845bfb2b534 |
| session | SESSION-e565a4fbf5cff09b | SESSION-e565a4fbf5cff09b |
| protocol_event | pe:tls:SESSION-bc4350b5c6d66f3f | pe:tls:SESSION-bc4350b5c6d66 |
| flow | flow:779733f74ceb | flow:779733f74ceb |
| behavior_group | BSG-DATA_EXFIL-e7f288856e4c | BSG-DATA_EXFIL-e7f288856e4c |
| dns_name | dns:bat.bing.com | dns:bat.bing.com |
| session | SESSION-858ec5d25a7b6232 | SESSION-858ec5d25a7b6232 |
| protocol_event | pe:tls:SESSION-184b3698d564c9c7 | pe:tls:SESSION-184b3698d564c |
| org | Akamai International B.V. | org:Akamai International B.V |
| flow | flow:4eed5ff51111 | flow:4eed5ff51111 |
| session | SESSION-bcd07bc8e00bd126 | SESSION-bcd07bc8e00bd126 |
| asn | asn:397273 | asn:397273 |
| port_hub | 58457 | port:tcp:58457 |
| flow | flow:4ac806f4d834 | flow:4ac806f4d834 |
| geo_point | geo_29.42270_-98.49270 | geo_29.42270_-98.49270 |
| flow | flow:ef26bc2c964d | flow:ef26bc2c964d |
| flow | flow:21a678dc75de | flow:21a678dc75de |
| behavior_group | BSG-BEACON-3fa1dca5627c | BSG-BEACON-3fa1dca5627c |
| session | SESSION-c4d9c40a7fec56be | SESSION-c4d9c40a7fec56be |
| port_hub | 60920 | port:udp:60920 |
| session | SESSION-8fd6ad39adf47a18 | SESSION-8fd6ad39adf47a18 |
| protocol_event | pe:syn:SESSION-06fade4febc8462c | pe:syn:SESSION-06fade4febc84 |
| service | https | svc:https |
| host | 216.24.57.251 | host:216.24.57.251 |
| host | 167.235.217.196 | host:167.235.217.196 |
| flow | flow:a25fcb74f721 | flow:a25fcb74f721 |
| protocol_event | pe:syn:SESSION-81e5b5be161de125 | pe:syn:SESSION-81e5b5be161de |
| host | 13.107.226.57 | host:13.107.226.57 |
| session | SESSION-9c845bfb2b534b59 | SESSION-9c845bfb2b534b59 |
| protocol_event | pe:syn:SESSION-9b68d4601d0ccd30 | pe:syn:SESSION-9b68d4601d0cc |
| flow | flow:7395be855a32 | flow:7395be855a32 |
| protocol_event | pe:dns:SESSION-68666b77cce29d40 | pe:dns:SESSION-68666b77cce29 |
| http_host | http_host:ctldl.windowsupdate.com | http_host:ctldl.windowsupdat |
| session | SESSION-329be171c0b80b92 | SESSION-329be171c0b80b92 |
| session | SESSION-787a71cfd2c6f769 | SESSION-787a71cfd2c6f769 |
| host | 97.178.32.239 | host:97.178.32.239 |
| asn | asn:20940 | asn:20940 |
| port_hub | 55880 | port:tcp:55880 |
| host | 192.200.0.112 | host:192.200.0.112 |
| session | SESSION-a019cb392bc23a7a | SESSION-a019cb392bc23a7a |
| session | SESSION-81e5b5be161de125 | SESSION-81e5b5be161de125 |
| session | SESSION-f32643b41a201d5b | SESSION-f32643b41a201d5b |
| protocol_event | pe:tls:SESSION-36cd4459caa078a9 | pe:tls:SESSION-36cd4459caa07 |
| flow | flow:0523b90826b8 | flow:0523b90826b8 |
| session | SESSION-c8f5f362e7c0c5c8 | SESSION-c8f5f362e7c0c5c8 |
| flow | flow:cb933110cf94 | flow:cb933110cf94 |
| flow | flow:df281449ac19 | flow:df281449ac19 |
| session | SESSION-423d6f8fa2a9f7bc | SESSION-423d6f8fa2a9f7bc |
| geo_point | geo_29.75390_-95.35900 | geo_29.75390_-95.35900 |
| protocol_event | pe:tls:SESSION-e881aa680da5dbf3 | pe:tls:SESSION-e881aa680da5d |
| asn | asn:16509 | asn:16509 |
| org | Fastly, Inc. | org:Fastly, Inc. |
| session | SESSION-b7d90a2138968fa3 | SESSION-b7d90a2138968fa3 |
| port_hub | 54629 | port:tcp:54629 |
| session | SESSION-e66fd8e05921da5d | SESSION-e66fd8e05921da5d |
| flow | flow:46c89f86a16a | flow:46c89f86a16a |
| flow | flow:00f4e10d6ac7 | flow:00f4e10d6ac7 |
| session | SESSION-36cd4459caa078a9 | SESSION-36cd4459caa078a9 |
| protocol_event | pe:syn:SESSION-8394aca80c2a0790 | pe:syn:SESSION-8394aca80c2a0 |
| flow | flow:9cc54a60d88a | flow:9cc54a60d88a |
| session | SESSION-e881aa680da5dbf3 | SESSION-e881aa680da5dbf3 |
| asn | asn:8075 | asn:8075 |
| port_hub | 443 | port:tcp:443 |
| behavior_group | BSG-HORIZ_SCAN-cd2c52661c4b | BSG-HORIZ_SCAN-cd2c52661c4b |
| session | SESSION-7dbcb4428a9e5e71 | SESSION-7dbcb4428a9e5e71 |
| port_hub | 443 | port:udp:443 |
| flow | flow:300bb0be41cf | flow:300bb0be41cf |
| protocol_event | pe:tls:SESSION-65a9e51617aa2712 | pe:tls:SESSION-65a9e51617aa2 |
| flow | flow:03d3562fa35f | flow:03d3562fa35f |
| flow | flow:ab2fda60ec38 | flow:ab2fda60ec38 |
| asn | asn:36236 | asn:36236 |
| protocol_event | pe:tls:SESSION-9dab8edd40d14d9d | pe:tls:SESSION-9dab8edd40d14 |
| geo_point | geo_34.02330_-117.85120 | geo_34.02330_-117.85120 |
| geo_point | geo_38.70950_-78.15390 | geo_38.70950_-78.15390 |
| host | 23.219.160.5 | host:23.219.160.5 |
| session | SESSION-1f115942b61afe54 | SESSION-1f115942b61afe54 |
| flow | flow:7fc08133133d | flow:7fc08133133d |
| flow | flow:26faad66f81e | flow:26faad66f81e |
| protocol_event | pe:tls:SESSION-348feef1c6ca6285 | pe:tls:SESSION-348feef1c6ca6 |
| flow | flow:4f5810e72704 | flow:4f5810e72704 |
| org | Hetzner Online GmbH | org:Hetzner Online GmbH |
| flow | flow:007f4ea11c64 | flow:007f4ea11c64 |
| host | 192.168.1.1 | host:192.168.1.1 |
| port_hub | 41641 | port:udp:41641 |
| protocol_event | pe:dns:SESSION-08bfd8721a383a39 | pe:dns:SESSION-08bfd8721a383 |
| host | 162.159.128.61 | host:162.159.128.61 |
| flow | flow:82ce7409c0ca | flow:82ce7409c0ca |
| session | SESSION-1ea83345da6e2df0 | SESSION-1ea83345da6e2df0 |
| session | SESSION-0e59fb5fe4c720df | SESSION-0e59fb5fe4c720df |
| flow | flow:df1c396b8733 | flow:df1c396b8733 |
| flow | flow:f5abaef54664 | flow:f5abaef54664 |
| host | 172.18.0.1 | host:172.18.0.1 |
| service | dns | svc:dns |
| session | SESSION-65a9e51617aa2712 | SESSION-65a9e51617aa2712 |
| flow | flow:481a8cb33c5b | flow:481a8cb33c5b |
| session | SESSION-e86e0a049372cc85 | SESSION-e86e0a049372cc85 |
| protocol_event | pe:tls:SESSION-7b2b00e0ceb88c09 | pe:tls:SESSION-7b2b00e0ceb88 |
| flow | flow:a3f08c1df1f5 | flow:a3f08c1df1f5 |
| protocol_event | pe:tls:SESSION-741380b5a9a3a6c7 | pe:tls:SESSION-741380b5a9a3a |
| asn | asn:396982 | asn:396982 |
| port_hub | 52640 | port:tcp:52640 |
| asn | asn:15169 | asn:15169 |
| protocol_event | pe:syn:SESSION-83d0b20751c23f69 | pe:syn:SESSION-83d0b20751c23 |
| session | SESSION-f8dc5b0051ee4914 | SESSION-f8dc5b0051ee4914 |
| port_hub | 51146 | port:tcp:51146 |
| port_hub | 51966 | port:tcp:51966 |
| flow | flow:c0b4f157e073 | flow:c0b4f157e073 |
| session | SESSION-8c7ddbb6fe26a9a9 | SESSION-8c7ddbb6fe26a9a9 |
| host | 23.213.232.172 | host:23.213.232.172 |
| host | 151.101.114.172 | host:151.101.114.172 |
| protocol_event | pe:tls:SESSION-e6ad21d692182871 | pe:tls:SESSION-e6ad21d692182 |
| session | SESSION-68666b77cce29d40 | SESSION-68666b77cce29d40 |
| protocol_event | pe:tls:SESSION-8394aca80c2a0790 | pe:tls:SESSION-8394aca80c2a0 |
| protocol_event | pe:tls:SESSION-04dc5a38b6cabcef | pe:tls:SESSION-04dc5a38b6cab |
| session | SESSION-06fade4febc8462c | SESSION-06fade4febc8462c |
| host | 192.73.243.135 | host:192.73.243.135 |
| dns_name | dns:signaler-pa.clients6.google.com | dns:signaler-pa.clients6.goo |
| session | SESSION-e6ad21d692182871 | SESSION-e6ad21d692182871 |
| session | SESSION-08bfd8721a383a39 | SESSION-08bfd8721a383a39 |
| flow | flow:dc8e0c394478 | flow:dc8e0c394478 |
| flow | flow:1fbee9feb06d | flow:1fbee9feb06d |
| flow | flow:d479ce3b7365 | flow:d479ce3b7365 |
| flow | flow:bf7a9427297d | flow:bf7a9427297d |
| session | SESSION-e5c653feb7de823f | SESSION-e5c653feb7de823f |
| flow | flow:05b4e5b174c0 | flow:05b4e5b174c0 |
| host | 216.239.32.223 | host:216.239.32.223 |
| host | 192.73.244.245 | host:192.73.244.245 |
| flow | flow:341692033057 | flow:341692033057 |
| flow | flow:5b983251f483 | flow:5b983251f483 |
| port_hub | 52133 | port:tcp:52133 |
| geo_point | geo_41.88350_-87.63050 | geo_41.88350_-87.63050 |
| geo_point | geo_37.75100_-97.82200 | geo_37.75100_-97.82200 |
| org | Amazon.com, Inc. | org:Amazon.com, Inc. |
| session | SESSION-441bb1af5ec88ffb | SESSION-441bb1af5ec88ffb |
| org | Render | org:Render |
| session | SESSION-8394aca80c2a0790 | SESSION-8394aca80c2a0790 |
| host | 172.19.0.1 | host:172.19.0.1 |
| session | SESSION-3cb87513d2c7904f | SESSION-3cb87513d2c7904f |
| host | 172.64.151.22 | host:172.64.151.22 |
| protocol_event | pe:tls:SESSION-8fd6ad39adf47a18 | pe:tls:SESSION-8fd6ad39adf47 |
| port_hub | 80 | port:tcp:80 |
| host | 135.234.174.40 | host:135.234.174.40 |
| session | SESSION-21bfec774060aafb | SESSION-21bfec774060aafb |
| flow | flow:0c699e4ab5c4 | flow:0c699e4ab5c4 |
| flow | flow:d658b18ff560 | flow:d658b18ff560 |
| flow | flow:bf8f4a131249 | flow:bf8f4a131249 |
| host | 216.24.57.7 | host:216.24.57.7 |
| protocol_event | pe:syn:SESSION-21bfec774060aafb | pe:syn:SESSION-21bfec774060a |
| host | 104.18.36.216 | host:104.18.36.216 |
| flow | flow:a912cd07306b | flow:a912cd07306b |
| session | SESSION-7bf53771cd98ec17 | SESSION-7bf53771cd98ec17 |
| session | SESSION-04dc5a38b6cabcef | SESSION-04dc5a38b6cabcef |
| flow | flow:c378386f9a22 | flow:c378386f9a22 |
| protocol_event | pe:tls:SESSION-a019cb392bc23a7a | pe:tls:SESSION-a019cb392bc23 |
| session | SESSION-1065a64ded6cc44c | SESSION-1065a64ded6cc44c |
| flow | flow:65175f124256 | flow:65175f124256 |
| session | SESSION-e0cdf80170e46e9e | SESSION-e0cdf80170e46e9e |
| host | 150.171.28.10 | host:150.171.28.10 |
| port_hub | 58631 | port:tcp:58631 |
| host | 209.177.158.246 | host:209.177.158.246 |
| host | 192.168.1.185 | host:192.168.1.185 |
| flow | flow:7986b2093729 | flow:7986b2093729 |
| flow | flow:51a92af49050 | flow:51a92af49050 |
| host | 104.18.32.47 | host:104.18.32.47 |
| flow | flow:d84a13678d67 | flow:d84a13678d67 |
| geo_point | geo_43.63190_-79.37160 | geo_43.63190_-79.37160 |
| org | Google LLC | org:Google LLC |
| host | 104.208.203.89 | host:104.208.203.89 |
| host | 34.111.31.13 | host:34.111.31.13 |
| dns_name | dns:browser.events.data.microsoft.com | dns:browser.events.data.micr |
| port_hub | 54986 | port:tcp:54986 |
| session | SESSION-055fd962754012c2 | SESSION-055fd962754012c2 |
| protocol_event | pe:tls:SESSION-0e59fb5fe4c720df | pe:tls:SESSION-0e59fb5fe4c72 |
| flow | flow:dd3dd13e1b60 | flow:dd3dd13e1b60 |
| asn | asn:6167 | asn:6167 |
| session | SESSION-86bc6b9e53c222b0 | SESSION-86bc6b9e53c222b0 |
| session | SESSION-5673cdc8e15ecc28 | SESSION-5673cdc8e15ecc28 |
| session | SESSION-99947e3aab494326 | SESSION-99947e3aab494326 |
| dns_name | dns:ctldl.windowsupdate.com | dns:ctldl.windowsupdate.com |
| port_hub | 31036 | port:udp:31036 |
| tls_sni | tls_sni:copilot.microsoft.com | tls_sni:copilot.microsoft.co |
| flow | flow:495f7c8d94fd | flow:495f7c8d94fd |
| flow | flow:e34282443dab | flow:e34282443dab |
| protocol_event | pe:tls:SESSION-d146af26ba988e06 | pe:tls:SESSION-d146af26ba988 |
| host | 104.18.22.222 | host:104.18.22.222 |
| flow | flow:1cae684ccaf1 | flow:1cae684ccaf1 |
| flow | flow:a42e7b1c53d5 | flow:a42e7b1c53d5 |
| flow | flow:7be9da9aa76d | flow:7be9da9aa76d |
| geo_point | geo_36.66940_-78.38770 | geo_36.66940_-78.38770 |
| session | SESSION-de97a19f0937505c | SESSION-de97a19f0937505c |
| session | SESSION-cbcc97483386b4f3 | SESSION-cbcc97483386b4f3 |
| session | SESSION-9b68d4601d0ccd30 | SESSION-9b68d4601d0ccd30 |
| session | SESSION-fa034e5132aecf5b | SESSION-fa034e5132aecf5b |
| flow | flow:60dd2a974649 | flow:60dd2a974649 |
| flow | flow:65c7de267840 | flow:65c7de267840 |
| port_hub | 52243 | port:udp:52243 |
| geo_point | geo_29.82840_-95.46960 | geo_29.82840_-95.46960 |
| host | 199.165.136.100 | host:199.165.136.100 |
| host | 151.101.113.140 | host:151.101.113.140 |
| port_hub | 62104 | port:tcp:62104 |
| flow | flow:0380e0cd29dc | flow:0380e0cd29dc |
| protocol_event | pe:syn:SESSION-cbcc97483386b4f3 | pe:syn:SESSION-cbcc97483386b |
| session | SESSION-dabcbf693ac9fbef | SESSION-dabcbf693ac9fbef |
| host | 142.250.113.95 | host:142.250.113.95 |
| session | SESSION-58f9cafe500f64ad | SESSION-58f9cafe500f64ad |
| session | SESSION-d7f6ed06cf3ab18b | SESSION-d7f6ed06cf3ab18b |
| protocol_event | pe:tls:SESSION-06fade4febc8462c | pe:tls:SESSION-06fade4febc84 |
| flow | flow:f79c1639a1f7 | flow:f79c1639a1f7 |
| protocol_event | pe:tls:SESSION-9c85e6a530e7f20f | pe:tls:SESSION-9c85e6a530e7f |
| session | SESSION-934baa2aae663ceb | SESSION-934baa2aae663ceb |
| flow | flow:f3b81336df74 | flow:f3b81336df74 |
| dns_name | dns:remotedesktop-pa.googleapis.com | dns:remotedesktop-pa.googlea |
| geo_point | geo_39.10270_-94.57780 | geo_39.10270_-94.57780 |
| geo_point | geo_32.77970_-96.80220 | geo_32.77970_-96.80220 |
| flow | flow:f19ee6508782 | flow:f19ee6508782 |
| dns_name | dns:chatgpt.com | dns:chatgpt.com |
| session | SESSION-e25097cf84c7b988 | SESSION-e25097cf84c7b988 |
| protocol_event | pe:tls:SESSION-200a1edeb5081c1b | pe:tls:SESSION-200a1edeb5081 |
| session | SESSION-9c85e6a530e7f20f | SESSION-9c85e6a530e7f20f |
| host | 142.250.115.95 | host:142.250.115.95 |
| protocol_event | pe:tls:SESSION-b7338ba843b2dafa | pe:tls:SESSION-b7338ba843b2d |
| host | 172.29.16.1 | host:172.29.16.1 |
| host | 224.0.0.22 | host:224.0.0.22 |
| dns_name | dns:copilot.microsoft.com | dns:copilot.microsoft.com |
| session | SESSION-1835bee014d5b0b3 | SESSION-1835bee014d5b0b3 |
| session | SESSION-4cf06bd9f9c07bb4 | SESSION-4cf06bd9f9c07bb4 |
| org | NetActuate, Inc | org:NetActuate, Inc |
| behavior_group | BSG-DATA_EXFIL-78b438a917b5 | BSG-DATA_EXFIL-78b438a917b5 |
| port_hub | 44244 | port:udp:44244 |
| flow | flow:46f60ddc23a2 | flow:46f60ddc23a2 |
| org | Microsoft Corporation | org:Microsoft Corporation |
| flow | flow:62d01d1bf747 | flow:62d01d1bf747 |
| tls_sni | tls_sni:browser.events.data.microsoft.com | tls_sni:browser.events.data. |
| org | Verizon Business | org:Verizon Business |
| flow | flow:fdf049da8b14 | flow:fdf049da8b14 |
| flow | flow:6fe67514daf4 | flow:6fe67514daf4 |
| flow | flow:3d20532e84ed | flow:3d20532e84ed |
| session | SESSION-22420a928847cfad | SESSION-22420a928847cfad |
| flow | flow:919c57e90236 | flow:919c57e90236 |
| session | SESSION-b7338ba843b2dafa | SESSION-b7338ba843b2dafa |
| service | http | svc:http |
| session | SESSION-65e185b6eab54d6a | SESSION-65e185b6eab54d6a |
| protocol_event | pe:tls:SESSION-dabcbf693ac9fbef | pe:tls:SESSION-dabcbf693ac9f |
| flow | flow:c44b4fd56f98 | flow:c44b4fd56f98 |
| session | SESSION-716de9787a03c45e | SESSION-716de9787a03c45e |
| session | SESSION-17e440ba96a7a7b5 | SESSION-17e440ba96a7a7b5 |
| protocol_event | pe:tls:SESSION-423d6f8fa2a9f7bc | pe:tls:SESSION-423d6f8fa2a9f |
| geo_point | geo_50.47770_12.36490 | geo_50.47770_12.36490 |
| session | SESSION-05305b96b26cdffd | SESSION-05305b96b26cdffd |
| tls_sni | tls_sni:chatgpt.com | tls_sni:chatgpt.com |
| port_hub | 1050 | port:udp:1050 |
| geo_point | geo_41.60150_-93.61270 | geo_41.60150_-93.61270 |
| host | 192.73.248.83 | host:192.73.248.83 |
| port_hub | 51049 | port:tcp:51049 |
| protocol_event | pe:tls:SESSION-502ccca87ddbbb24 | pe:tls:SESSION-502ccca87ddbb |
| host | 172.17.0.1 | host:172.17.0.1 |
| port_hub | 46407 | port:tcp:46407 |
| behavior_group | BSG-BEACON-4bc57cbec7cd | BSG-BEACON-4bc57cbec7cd |
| flow | flow:137f07aaadb4 | flow:137f07aaadb4 |
| geo_point | geo_25.77010_-80.19280 | geo_25.77010_-80.19280 |
| asn | asn:14618 | asn:14618 |
| protocol_event | pe:tls:SESSION-441bb1af5ec88ffb | pe:tls:SESSION-441bb1af5ec88 |
| protocol_event | pe:syn:SESSION-d146af26ba988e06 | pe:syn:SESSION-d146af26ba988 |
| pcap_artifact | PCAP:cap_05182026_430pmCST:aee251eecdd8 | PCAP:cap_05182026_430pmCST:a |
| session | SESSION-d146af26ba988e06 | SESSION-d146af26ba988e06 |
| session | SESSION-2681df7af5f78270 | SESSION-2681df7af5f78270 |
| flow | flow:d83699920b5b | flow:d83699920b5b |
| host | 151.101.112.217 | host:151.101.112.217 |
| session | SESSION-bc4350b5c6d66f3f | SESSION-bc4350b5c6d66f3f |
| host | 76.76.21.22 | host:76.76.21.22 |
| session | SESSION-ce6603a48a5c4c37 | SESSION-ce6603a48a5c4c37 |
| flow | flow:682d5368c69e | flow:682d5368c69e |
| port_hub | 43844 | port:tcp:43844 |
| port_hub | 51645 | port:tcp:51645 |
| session | SESSION-7b2b00e0ceb88c09 | SESSION-7b2b00e0ceb88c09 |
| protocol_event | pe:tls:SESSION-ea1d23994577309a | pe:tls:SESSION-ea1d239945773 |
| port_hub | 11130 | port:udp:11130 |
| protocol_event | pe:tls:SESSION-c4d9c40a7fec56be | pe:tls:SESSION-c4d9c40a7fec5 |
| session | SESSION-ea1d23994577309a | SESSION-ea1d23994577309a |
| session | SESSION-10cf97843d85c279 | SESSION-10cf97843d85c279 |
| flow | flow:eb3b47352f67 | flow:eb3b47352f67 |
| host | 20.62.59.32 | host:20.62.59.32 |
| port_hub | 53 | port:udp:53 |
| session | SESSION-348feef1c6ca6285 | SESSION-348feef1c6ca6285 |
| protocol_event | pe:tls:SESSION-fa034e5132aecf5b | pe:tls:SESSION-fa034e5132aec |
| host | 209.177.156.94 | host:209.177.156.94 |
| host | 35.190.80.1 | host:35.190.80.1 |
| flow | flow:9aa8161296f7 | flow:9aa8161296f7 |
| flow | flow:5a246bdf60e4 | flow:5a246bdf60e4 |
| session | SESSION-502ccca87ddbbb24 | SESSION-502ccca87ddbbb24 |
| Kind | Src | Dst | |
|---|---|---|---|
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TLS_SNI | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| ASN_IN_ORG | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| HOST_IN_ASN | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_FROM_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| ASN_IN_ORG | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| PORT_IMPLIED_SERVICE | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| HOST_IN_ASN | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| HOST_IN_ASN | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TLS_SNI | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| HOST_IN_ASN | → | ||
| ASN_IN_ORG | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_IN_ASN | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| flow_observed | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_QUERIED_DNS | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| PORT_IMPLIED_SERVICE | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_QUERIED_DNS | → | ||
| flow_observed | → | ||
| FLOW_QUERIED_DNS | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_QUERIED_DNS | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| ASN_IN_ORG | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| HOST_IN_ASN | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_FROM_HOST | → | ||
| ASN_IN_ORG | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_IN_ASN | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| ASN_IN_ORG | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| ASN_IN_ORG | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_HTTP_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| ASN_IN_ORG | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| flow_observed | → | ||
| FLOW_DST_PORT | → | ||
| HOST_IN_ASN | → | ||
| FLOW_DST_PORT | → | ||
| HOST_IN_ASN | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_IN_ASN | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| HOST_IN_ASN | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| ASN_IN_ORG | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_TLS_SNI | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| PORT_IMPLIED_SERVICE | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_DST_PORT | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| ASN_IN_ORG | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| HOST_IN_ASN | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| ASN_IN_ORG | → | ||
| FLOW_DST_PORT | → | ||
| flow_observed | → | ||
| flow_observed | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| flow_observed | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TLS_SNI | → | ||
| flow_observed | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| PORT_IMPLIED_SERVICE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| flow_observed | → | ||
| FLOW_FROM_HOST | → | ||
| HOST_IN_ASN | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| HOST_GEO_ESTIMATE | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_IN_ASN | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| flow_observed | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| HOST_IN_ASN | → | ||
| HOST_IN_ASN | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_QUERIED_DNS | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_DST_PORT | → | ||
| HOST_IN_ASN | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| flow_observed | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| HOST_IN_ASN | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| flow_observed | → | ||
| FLOW_FROM_HOST | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| FLOW_TO_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| HOST_IN_ASN | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_FROM_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| HOST_GEO_ESTIMATE | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| FLOW_DST_PORT | → | ||
| FLOW_FROM_HOST | → | ||
| flow_observed | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| flow_observed | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_CONTAINS_EVENT | → | ||
| SESSION_MEMBER_OF_BEHAVIOR_GROUP | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_DERIVED_FROM_PCAP | → | ||
| SESSION_OBSERVED_HOST | → | ||
| flow_observed | → | ||
| FLOW_TO_HOST | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_FLOW | → | ||
| flow_observed | → | ||
| SESSION_BETWEEN_HOSTS | → | ||
| HOST_IN_ASN | → | ||
| SESSION_OBSERVED_HOST | → | ||
| SESSION_OBSERVED_HOST | → |