LetsDefend Tour - Log Management

Log Management

Log Management - LetsDefend

New Search
2577 events (before May, 15, 2024, 04:56 AM)
Hide Fields
INTERESTING FIELDS
α type
α source_address
# source_port
α destination_address
# destination_port
α raw_log
Event

[Aug, 29, 2020, 10:28 PM] source_address=172.16.17.14 source_port=47741 destination_address=198.100.45.154 destination_port=80 raw_log: {'Request URL': 'http://qstride.com/img/0/', 'Request Method': 'GET', 'Device Action': 'Permitted', 'Process': 'powershell.exe', 'Parent Process': 'PTD-080120 ZGO-082920.doc', 'Parent Process MD5': '21b3a9b03027779dc3070481a468b211'}

[Aug, 29, 2020, 10:32 PM] source_address=172.16.17.14 source_port=57441 destination_address=67.68.210.95 destination_port=80 raw_log: {'Request URL': 'http://67.68.210.95/HX8tpawYAxLaiFMTGa1/1dG3m5wmqVifrhsZXsG/', 'Request Method': 'POST', 'Device Action': 'Permitted', 'Process': 'rasser.exe', 'Parent MD5': 'bac591433cdada740aab065885d408bc'}

[Oct, 11, 2020, 09:41 PM] source_address=172.16.17.47 source_port=41221 destination_address=172.217.17.238 destination_port=443 raw_log: {'URL': 'https://www.google.com/search?q=covid+19+results'}

[Aug, 29, 2020, 11:00 PM] source_address=63.35.133.186 source_port=47847 destination_address=172.16.20.3 destination_port=25 raw_log: {'Sender Mail': 'info@nexoiberica.com', 'Destination Mail': 'mark@letsdefend.io'}

[Aug, 29, 2020, 11:09 PM] source_address=172.16.17.88 source_port=23477 destination_address=81.169.145.105 destination_port=80 raw_log: {'Request URL': 'http://thuening.de/cgi-bin/uo9wm/', 'Request Method': 'GET', 'Device Action': 'Permitted', 'Process': 'powershell.exe', 'Parent Process': 'BAL_GB9684140238GE.doc', 'Parent MD5': 'ac596d282e2f9b1501d66fce5a451f00'}

[Feb, 06, 2021, 12:42 PM] source_address=172.16.17.34 source_port=23512 destination_address=49.233.160.217 destination_port=443 raw_log: {'URL': 'https://github.com'}

[Feb, 06, 2021, 03:40 PM] source_address=172.16.17.35 source_port=56442 destination_address=172.16.17.45 destination_port=21 raw_log: {'Firewall Action': 'Blocked'}

[Feb, 14, 2021, 12:13 PM] source_address=172.16.17.49 source_port=14474 destination_address=67.68.210.95 destination_port=80 raw_log: {'URL': 'http://67.68.210.95/2SjAcA5VhhJiFjBQ/vvszin6AicmidnG5bg/DaDVVYvfEHlcIIcgcu/0U5UiIkaHankrHGa/FYSJmdQDj2ejni1UI/', 'Device Actiov': 'Allowed'}

[Feb, 22, 2021, 04:31 PM] source_address=49.234.71.65 source_port=42212 destination_address=172.16.20.4 destination_port=80 raw_log: {'Request URL': '172.16.20.4/srcCode/upload.php', 'Request Method': 'GET', 'Device Action': 'Allowed'}

[Feb, 21, 2021, 05:02 PM] source_address=172.16.20.4 source_port=80 destination_address=49.234.71.65 destination_port=33212 raw_log: {'Response Code': '404'}

1
2
3
4
5
…
258

Show Filter
DATE
TYPE
SRC ADDRESS
SRC PORT
DEST. ADDRESS
DEST. PORT
RAW
Aug, 29, 2020, 10:28 PM
Proxy
172.16.17.14
47741
198.100.45.154
80
Aug, 29, 2020, 10:32 PM
Proxy
172.16.17.14
57441
67.68.210.95
80
Oct, 11, 2020, 09:41 PM
Proxy
172.16.17.47
41221
172.217.17.238
443
Aug, 29, 2020, 11:00 PM
Exchange
63.35.133.186
47847
172.16.20.3
25
Aug, 29, 2020, 11:09 PM
Proxy
172.16.17.88
23477
81.169.145.105
80
Feb, 06, 2021, 12:42 PM
Firewall
172.16.17.34
23512
49.233.160.217
443
Feb, 06, 2021, 03:40 PM
Firewall
172.16.17.35
56442
172.16.17.45
21
Feb, 14, 2021, 12:13 PM
Proxy
172.16.17.49
14474
67.68.210.95
80
Feb, 22, 2021, 04:31 PM
Proxy
49.234.71.65
42212
172.16.20.4
80
Feb, 21, 2021, 05:02 PM
Proxy
172.16.20.4
80
49.234.71.65
33212
1
2
3
4
5
…
258

Show Filter
DATE
TYPE
SRC ADDRESS
SRC PORT
DEST. ADDRESS
DEST. PORT
RAW
May, 03, 2024, 05:33 PM
Firewall
172.16.20.151
34636
99.84.192.100
443
May, 04, 2024, 08:42 AM
Firewall
172.16.20.151
33178
52.94.225.248
443
May, 06, 2024, 09:58 AM
Firewall
172.16.20.151
35643
13.82.28.61
443
May, 10, 2024, 09:45 AM
Firewall
172.16.20.151
36927
157.240.238.60
443
May, 07, 2024, 02:21 AM
Firewall
172.16.20.151
28277
3.225.92.8
443
May, 09, 2024, 10:39 PM
Firewall
172.16.20.151
12071
3.211.157.115
443
May, 07, 2024, 12:10 AM
Firewall
172.16.20.151
14415
104.20.59.209
443
May, 08, 2024, 07:25 AM
Firewall
172.16.20.151
63112
173.194.193.139
443
May, 08, 2024, 06:43 AM
Firewall
172.16.20.151
32083
35.230.172.69
443
May, 07, 2024, 05:00 AM
Firewall
172.16.20.151
33739
104.244.42.65
443
1
2

May, 13, 2024, 12:59 PM
Proxy
172.16.20.151
49842
3.5.129.143
443

RAW LOG

Date: 2024-05-13 12:59:44

Device Action: Allowed

User: Felix

URL: https://files-ld.s3.us-east-2.amazonaws.com/free-coffee.zip

Process: chrome.exe

May, 13, 2024, 01:01 PM
Firewall
172.16.20.151
49868
37.120.233.226
3451

RAW LOG

Source IP: 172.16.20.151

Destination IP: 37.120.233.226

Destination Port: 3451

Protocol: TCP

Action: FW Permit

Process: Coffee.exe

May, 13, 2024, 01:00 PM
Firewall
172.16.20.151
49853
127.0.0.1
3451

RAW LOG

Source IP: 172.16.20.151

Destination IP: 127.0.0.1

Destination Port: 3451

Protocol: TCP

Action: FW Deny

Process: Coffee.exe