mirror of
https://github.com/mblanke/ThreatHunt.git
synced 2026-03-01 05:50:21 -05:00
chore: checkpoint all local changes
This commit is contained in:
@@ -0,0 +1,72 @@
|
||||
"""add cases and activity logs
|
||||
|
||||
Revision ID: a3b1c2d4e5f6
|
||||
Revises: 98ab619418bc
|
||||
Create Date: 2025-01-01 00:00:00.000000
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
revision: str = "a3b1c2d4e5f6"
|
||||
down_revision: Union[str, None] = "98ab619418bc"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"cases",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("title", sa.String(512), nullable=False),
|
||||
sa.Column("description", sa.Text, nullable=True),
|
||||
sa.Column("severity", sa.String(16), server_default="medium"),
|
||||
sa.Column("tlp", sa.String(16), server_default="amber"),
|
||||
sa.Column("pap", sa.String(16), server_default="amber"),
|
||||
sa.Column("status", sa.String(24), server_default="open"),
|
||||
sa.Column("priority", sa.Integer, server_default="2"),
|
||||
sa.Column("assignee", sa.String(128), nullable=True),
|
||||
sa.Column("tags", sa.JSON, nullable=True),
|
||||
sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
|
||||
sa.Column("owner_id", sa.String(32), sa.ForeignKey("users.id"), nullable=True),
|
||||
sa.Column("mitre_techniques", sa.JSON, nullable=True),
|
||||
sa.Column("iocs", sa.JSON, nullable=True),
|
||||
sa.Column("started_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
op.create_index("ix_cases_hunt", "cases", ["hunt_id"])
|
||||
op.create_index("ix_cases_status", "cases", ["status"])
|
||||
|
||||
op.create_table(
|
||||
"case_tasks",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("case_id", sa.String(32), sa.ForeignKey("cases.id", ondelete="CASCADE"), nullable=False),
|
||||
sa.Column("title", sa.String(512), nullable=False),
|
||||
sa.Column("description", sa.Text, nullable=True),
|
||||
sa.Column("status", sa.String(24), server_default="todo"),
|
||||
sa.Column("assignee", sa.String(128), nullable=True),
|
||||
sa.Column("order", sa.Integer, server_default="0"),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
op.create_index("ix_case_tasks_case", "case_tasks", ["case_id"])
|
||||
|
||||
op.create_table(
|
||||
"activity_logs",
|
||||
sa.Column("id", sa.Integer, primary_key=True, autoincrement=True),
|
||||
sa.Column("entity_type", sa.String(32), nullable=False),
|
||||
sa.Column("entity_id", sa.String(32), nullable=False),
|
||||
sa.Column("action", sa.String(64), nullable=False),
|
||||
sa.Column("details", sa.JSON, nullable=True),
|
||||
sa.Column("user_id", sa.String(32), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
|
||||
)
|
||||
op.create_index("ix_activity_entity", "activity_logs", ["entity_type", "entity_id"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_table("activity_logs")
|
||||
op.drop_table("case_tasks")
|
||||
op.drop_table("cases")
|
||||
@@ -0,0 +1,63 @@
|
||||
"""add alerts and alert_rules tables
|
||||
|
||||
Revision ID: b4c2d3e5f6a7
|
||||
Revises: a3b1c2d4e5f6
|
||||
Create Date: 2025-01-01 00:00:00.000000
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
# revision identifiers
|
||||
revision: str = "b4c2d3e5f6a7"
|
||||
down_revision: Union[str, None] = "a3b1c2d4e5f6"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"alerts",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("title", sa.String(512), nullable=False),
|
||||
sa.Column("description", sa.Text, nullable=True),
|
||||
sa.Column("severity", sa.String(16), server_default="medium"),
|
||||
sa.Column("status", sa.String(24), server_default="new"),
|
||||
sa.Column("analyzer", sa.String(64), nullable=False),
|
||||
sa.Column("score", sa.Float, server_default="0"),
|
||||
sa.Column("evidence", sa.JSON, nullable=True),
|
||||
sa.Column("mitre_technique", sa.String(32), nullable=True),
|
||||
sa.Column("tags", sa.JSON, nullable=True),
|
||||
sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
|
||||
sa.Column("dataset_id", sa.String(32), sa.ForeignKey("datasets.id"), nullable=True),
|
||||
sa.Column("case_id", sa.String(32), sa.ForeignKey("cases.id"), nullable=True),
|
||||
sa.Column("assignee", sa.String(128), nullable=True),
|
||||
sa.Column("acknowledged_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("resolved_at", sa.DateTime(timezone=True), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
)
|
||||
op.create_index("ix_alerts_severity", "alerts", ["severity"])
|
||||
op.create_index("ix_alerts_status", "alerts", ["status"])
|
||||
op.create_index("ix_alerts_hunt", "alerts", ["hunt_id"])
|
||||
op.create_index("ix_alerts_dataset", "alerts", ["dataset_id"])
|
||||
|
||||
op.create_table(
|
||||
"alert_rules",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("name", sa.String(256), nullable=False),
|
||||
sa.Column("description", sa.Text, nullable=True),
|
||||
sa.Column("analyzer", sa.String(64), nullable=False),
|
||||
sa.Column("config", sa.JSON, nullable=True),
|
||||
sa.Column("severity_override", sa.String(16), nullable=True),
|
||||
sa.Column("enabled", sa.Boolean, server_default=sa.text("1")),
|
||||
sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
)
|
||||
op.create_index("ix_alert_rules_analyzer", "alert_rules", ["analyzer"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_table("alert_rules")
|
||||
op.drop_table("alerts")
|
||||
@@ -0,0 +1,54 @@
|
||||
"""add notebooks and playbook_runs tables
|
||||
|
||||
Revision ID: c5d3e4f6a7b8
|
||||
Revises: b4c2d3e5f6a7
|
||||
Create Date: 2025-01-01 00:00:00.000000
|
||||
"""
|
||||
from typing import Sequence, Union
|
||||
from alembic import op
|
||||
import sqlalchemy as sa
|
||||
|
||||
revision: str = "c5d3e4f6a7b8"
|
||||
down_revision: Union[str, None] = "b4c2d3e5f6a7"
|
||||
branch_labels: Union[str, Sequence[str], None] = None
|
||||
depends_on: Union[str, Sequence[str], None] = None
|
||||
|
||||
|
||||
def upgrade() -> None:
|
||||
op.create_table(
|
||||
"notebooks",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("title", sa.String(512), nullable=False),
|
||||
sa.Column("description", sa.Text, nullable=True),
|
||||
sa.Column("cells", sa.JSON, nullable=True),
|
||||
sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
|
||||
sa.Column("case_id", sa.String(32), sa.ForeignKey("cases.id"), nullable=True),
|
||||
sa.Column("owner_id", sa.String(32), sa.ForeignKey("users.id"), nullable=True),
|
||||
sa.Column("tags", sa.JSON, nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
)
|
||||
op.create_index("ix_notebooks_hunt", "notebooks", ["hunt_id"])
|
||||
|
||||
op.create_table(
|
||||
"playbook_runs",
|
||||
sa.Column("id", sa.String(32), primary_key=True),
|
||||
sa.Column("playbook_name", sa.String(256), nullable=False),
|
||||
sa.Column("status", sa.String(24), server_default="in-progress"),
|
||||
sa.Column("current_step", sa.Integer, server_default="1"),
|
||||
sa.Column("total_steps", sa.Integer, server_default="0"),
|
||||
sa.Column("step_results", sa.JSON, nullable=True),
|
||||
sa.Column("hunt_id", sa.String(32), sa.ForeignKey("hunts.id"), nullable=True),
|
||||
sa.Column("case_id", sa.String(32), sa.ForeignKey("cases.id"), nullable=True),
|
||||
sa.Column("started_by", sa.String(128), nullable=True),
|
||||
sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
|
||||
sa.Column("completed_at", sa.DateTime(timezone=True), nullable=True),
|
||||
)
|
||||
op.create_index("ix_playbook_runs_hunt", "playbook_runs", ["hunt_id"])
|
||||
op.create_index("ix_playbook_runs_status", "playbook_runs", ["status"])
|
||||
|
||||
|
||||
def downgrade() -> None:
|
||||
op.drop_table("playbook_runs")
|
||||
op.drop_table("notebooks")
|
||||
404
backend/app/api/routes/alerts.py
Normal file
404
backend/app/api/routes/alerts.py
Normal file
@@ -0,0 +1,404 @@
|
||||
"""API routes for alerts — CRUD, analyze triggers, and alert rules."""
|
||||
|
||||
import logging
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select, func, desc
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db import get_db
|
||||
from app.db.models import Alert, AlertRule, _new_id, _utcnow
|
||||
from app.db.repositories.datasets import DatasetRepository
|
||||
from app.services.analyzers import (
|
||||
get_available_analyzers,
|
||||
get_analyzer,
|
||||
run_all_analyzers,
|
||||
AlertCandidate,
|
||||
)
|
||||
from app.services.process_tree import _fetch_rows
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/alerts", tags=["alerts"])
|
||||
|
||||
|
||||
# ── Pydantic models ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
class AlertUpdate(BaseModel):
|
||||
status: Optional[str] = None
|
||||
severity: Optional[str] = None
|
||||
assignee: Optional[str] = None
|
||||
case_id: Optional[str] = None
|
||||
tags: Optional[list[str]] = None
|
||||
|
||||
|
||||
class RuleCreate(BaseModel):
|
||||
name: str
|
||||
description: Optional[str] = None
|
||||
analyzer: str
|
||||
config: Optional[dict] = None
|
||||
severity_override: Optional[str] = None
|
||||
enabled: bool = True
|
||||
hunt_id: Optional[str] = None
|
||||
|
||||
|
||||
class RuleUpdate(BaseModel):
|
||||
name: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
config: Optional[dict] = None
|
||||
severity_override: Optional[str] = None
|
||||
enabled: Optional[bool] = None
|
||||
|
||||
|
||||
class AnalyzeRequest(BaseModel):
|
||||
dataset_id: Optional[str] = None
|
||||
hunt_id: Optional[str] = None
|
||||
analyzers: Optional[list[str]] = None # None = run all
|
||||
config: Optional[dict] = None
|
||||
auto_create: bool = True # automatically persist alerts
|
||||
|
||||
|
||||
# ── Helpers ───────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
def _alert_to_dict(a: Alert) -> dict:
|
||||
return {
|
||||
"id": a.id,
|
||||
"title": a.title,
|
||||
"description": a.description,
|
||||
"severity": a.severity,
|
||||
"status": a.status,
|
||||
"analyzer": a.analyzer,
|
||||
"score": a.score,
|
||||
"evidence": a.evidence or [],
|
||||
"mitre_technique": a.mitre_technique,
|
||||
"tags": a.tags or [],
|
||||
"hunt_id": a.hunt_id,
|
||||
"dataset_id": a.dataset_id,
|
||||
"case_id": a.case_id,
|
||||
"assignee": a.assignee,
|
||||
"acknowledged_at": a.acknowledged_at.isoformat() if a.acknowledged_at else None,
|
||||
"resolved_at": a.resolved_at.isoformat() if a.resolved_at else None,
|
||||
"created_at": a.created_at.isoformat() if a.created_at else None,
|
||||
"updated_at": a.updated_at.isoformat() if a.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
def _rule_to_dict(r: AlertRule) -> dict:
|
||||
return {
|
||||
"id": r.id,
|
||||
"name": r.name,
|
||||
"description": r.description,
|
||||
"analyzer": r.analyzer,
|
||||
"config": r.config,
|
||||
"severity_override": r.severity_override,
|
||||
"enabled": r.enabled,
|
||||
"hunt_id": r.hunt_id,
|
||||
"created_at": r.created_at.isoformat() if r.created_at else None,
|
||||
"updated_at": r.updated_at.isoformat() if r.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
# ── Alert CRUD ────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get("", summary="List alerts")
|
||||
async def list_alerts(
|
||||
status: str | None = Query(None),
|
||||
severity: str | None = Query(None),
|
||||
analyzer: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
dataset_id: str | None = Query(None),
|
||||
limit: int = Query(100, ge=1, le=500),
|
||||
offset: int = Query(0, ge=0),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
stmt = select(Alert)
|
||||
count_stmt = select(func.count(Alert.id))
|
||||
if status:
|
||||
stmt = stmt.where(Alert.status == status)
|
||||
count_stmt = count_stmt.where(Alert.status == status)
|
||||
if severity:
|
||||
stmt = stmt.where(Alert.severity == severity)
|
||||
count_stmt = count_stmt.where(Alert.severity == severity)
|
||||
if analyzer:
|
||||
stmt = stmt.where(Alert.analyzer == analyzer)
|
||||
count_stmt = count_stmt.where(Alert.analyzer == analyzer)
|
||||
if hunt_id:
|
||||
stmt = stmt.where(Alert.hunt_id == hunt_id)
|
||||
count_stmt = count_stmt.where(Alert.hunt_id == hunt_id)
|
||||
if dataset_id:
|
||||
stmt = stmt.where(Alert.dataset_id == dataset_id)
|
||||
count_stmt = count_stmt.where(Alert.dataset_id == dataset_id)
|
||||
|
||||
total = (await db.execute(count_stmt)).scalar() or 0
|
||||
results = (await db.execute(
|
||||
stmt.order_by(desc(Alert.score), desc(Alert.created_at)).offset(offset).limit(limit)
|
||||
)).scalars().all()
|
||||
|
||||
return {"alerts": [_alert_to_dict(a) for a in results], "total": total}
|
||||
|
||||
|
||||
@router.get("/stats", summary="Alert statistics dashboard")
|
||||
async def alert_stats(
|
||||
hunt_id: str | None = Query(None),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Return aggregated alert statistics."""
|
||||
base = select(Alert)
|
||||
if hunt_id:
|
||||
base = base.where(Alert.hunt_id == hunt_id)
|
||||
|
||||
# Severity breakdown
|
||||
sev_stmt = select(Alert.severity, func.count(Alert.id)).group_by(Alert.severity)
|
||||
if hunt_id:
|
||||
sev_stmt = sev_stmt.where(Alert.hunt_id == hunt_id)
|
||||
sev_rows = (await db.execute(sev_stmt)).all()
|
||||
severity_counts = {s: c for s, c in sev_rows}
|
||||
|
||||
# Status breakdown
|
||||
status_stmt = select(Alert.status, func.count(Alert.id)).group_by(Alert.status)
|
||||
if hunt_id:
|
||||
status_stmt = status_stmt.where(Alert.hunt_id == hunt_id)
|
||||
status_rows = (await db.execute(status_stmt)).all()
|
||||
status_counts = {s: c for s, c in status_rows}
|
||||
|
||||
# Analyzer breakdown
|
||||
analyzer_stmt = select(Alert.analyzer, func.count(Alert.id)).group_by(Alert.analyzer)
|
||||
if hunt_id:
|
||||
analyzer_stmt = analyzer_stmt.where(Alert.hunt_id == hunt_id)
|
||||
analyzer_rows = (await db.execute(analyzer_stmt)).all()
|
||||
analyzer_counts = {a: c for a, c in analyzer_rows}
|
||||
|
||||
# Top MITRE techniques
|
||||
mitre_stmt = (
|
||||
select(Alert.mitre_technique, func.count(Alert.id))
|
||||
.where(Alert.mitre_technique.isnot(None))
|
||||
.group_by(Alert.mitre_technique)
|
||||
.order_by(desc(func.count(Alert.id)))
|
||||
.limit(10)
|
||||
)
|
||||
if hunt_id:
|
||||
mitre_stmt = mitre_stmt.where(Alert.hunt_id == hunt_id)
|
||||
mitre_rows = (await db.execute(mitre_stmt)).all()
|
||||
top_mitre = [{"technique": t, "count": c} for t, c in mitre_rows]
|
||||
|
||||
total = sum(severity_counts.values())
|
||||
|
||||
return {
|
||||
"total": total,
|
||||
"severity_counts": severity_counts,
|
||||
"status_counts": status_counts,
|
||||
"analyzer_counts": analyzer_counts,
|
||||
"top_mitre": top_mitre,
|
||||
}
|
||||
|
||||
|
||||
@router.get("/{alert_id}", summary="Get alert detail")
|
||||
async def get_alert(alert_id: str, db: AsyncSession = Depends(get_db)):
|
||||
result = await db.get(Alert, alert_id)
|
||||
if not result:
|
||||
raise HTTPException(status_code=404, detail="Alert not found")
|
||||
return _alert_to_dict(result)
|
||||
|
||||
|
||||
@router.put("/{alert_id}", summary="Update alert (status, assignee, etc.)")
|
||||
async def update_alert(
|
||||
alert_id: str, body: AlertUpdate, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
alert = await db.get(Alert, alert_id)
|
||||
if not alert:
|
||||
raise HTTPException(status_code=404, detail="Alert not found")
|
||||
|
||||
if body.status is not None:
|
||||
alert.status = body.status
|
||||
if body.status == "acknowledged" and not alert.acknowledged_at:
|
||||
alert.acknowledged_at = _utcnow()
|
||||
if body.status in ("resolved", "false-positive") and not alert.resolved_at:
|
||||
alert.resolved_at = _utcnow()
|
||||
if body.severity is not None:
|
||||
alert.severity = body.severity
|
||||
if body.assignee is not None:
|
||||
alert.assignee = body.assignee
|
||||
if body.case_id is not None:
|
||||
alert.case_id = body.case_id
|
||||
if body.tags is not None:
|
||||
alert.tags = body.tags
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(alert)
|
||||
return _alert_to_dict(alert)
|
||||
|
||||
|
||||
@router.delete("/{alert_id}", summary="Delete alert")
|
||||
async def delete_alert(alert_id: str, db: AsyncSession = Depends(get_db)):
|
||||
alert = await db.get(Alert, alert_id)
|
||||
if not alert:
|
||||
raise HTTPException(status_code=404, detail="Alert not found")
|
||||
await db.delete(alert)
|
||||
await db.commit()
|
||||
return {"ok": True}
|
||||
|
||||
|
||||
# ── Bulk operations ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.post("/bulk-update", summary="Bulk update alert statuses")
|
||||
async def bulk_update_alerts(
|
||||
alert_ids: list[str],
|
||||
status: str = Query(...),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
updated = 0
|
||||
for aid in alert_ids:
|
||||
alert = await db.get(Alert, aid)
|
||||
if alert:
|
||||
alert.status = status
|
||||
if status == "acknowledged" and not alert.acknowledged_at:
|
||||
alert.acknowledged_at = _utcnow()
|
||||
if status in ("resolved", "false-positive") and not alert.resolved_at:
|
||||
alert.resolved_at = _utcnow()
|
||||
updated += 1
|
||||
await db.commit()
|
||||
return {"updated": updated}
|
||||
|
||||
|
||||
# ── Run Analyzers ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get("/analyzers/list", summary="List available analyzers")
|
||||
async def list_analyzers():
|
||||
return {"analyzers": get_available_analyzers()}
|
||||
|
||||
|
||||
@router.post("/analyze", summary="Run analyzers on a dataset/hunt and optionally create alerts")
|
||||
async def run_analysis(
|
||||
request: AnalyzeRequest, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
if not request.dataset_id and not request.hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
|
||||
# Load rows
|
||||
rows_objs = await _fetch_rows(
|
||||
db, dataset_id=request.dataset_id, hunt_id=request.hunt_id, limit=10000,
|
||||
)
|
||||
if not rows_objs:
|
||||
raise HTTPException(status_code=404, detail="No rows found")
|
||||
|
||||
rows = [r.normalized_data or r.data for r in rows_objs]
|
||||
|
||||
# Run analyzers
|
||||
candidates = await run_all_analyzers(rows, enabled=request.analyzers, config=request.config)
|
||||
|
||||
created_alerts: list[dict] = []
|
||||
if request.auto_create and candidates:
|
||||
for c in candidates:
|
||||
alert = Alert(
|
||||
id=_new_id(),
|
||||
title=c.title,
|
||||
description=c.description,
|
||||
severity=c.severity,
|
||||
analyzer=c.analyzer,
|
||||
score=c.score,
|
||||
evidence=c.evidence,
|
||||
mitre_technique=c.mitre_technique,
|
||||
tags=c.tags,
|
||||
hunt_id=request.hunt_id,
|
||||
dataset_id=request.dataset_id,
|
||||
)
|
||||
db.add(alert)
|
||||
created_alerts.append(_alert_to_dict(alert))
|
||||
await db.commit()
|
||||
|
||||
return {
|
||||
"candidates_found": len(candidates),
|
||||
"alerts_created": len(created_alerts),
|
||||
"alerts": created_alerts,
|
||||
"summary": {
|
||||
"by_severity": _count_by(candidates, "severity"),
|
||||
"by_analyzer": _count_by(candidates, "analyzer"),
|
||||
"rows_analyzed": len(rows),
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
def _count_by(items: list[AlertCandidate], attr: str) -> dict[str, int]:
|
||||
counts: dict[str, int] = {}
|
||||
for item in items:
|
||||
key = getattr(item, attr, "unknown")
|
||||
counts[key] = counts.get(key, 0) + 1
|
||||
return counts
|
||||
|
||||
|
||||
# ── Alert Rules CRUD ─────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get("/rules/list", summary="List alert rules")
|
||||
async def list_rules(
|
||||
enabled: bool | None = Query(None),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
stmt = select(AlertRule)
|
||||
if enabled is not None:
|
||||
stmt = stmt.where(AlertRule.enabled == enabled)
|
||||
results = (await db.execute(stmt.order_by(AlertRule.created_at))).scalars().all()
|
||||
return {"rules": [_rule_to_dict(r) for r in results]}
|
||||
|
||||
|
||||
@router.post("/rules", summary="Create alert rule")
|
||||
async def create_rule(body: RuleCreate, db: AsyncSession = Depends(get_db)):
|
||||
# Validate analyzer exists
|
||||
if not get_analyzer(body.analyzer):
|
||||
raise HTTPException(status_code=400, detail=f"Unknown analyzer: {body.analyzer}")
|
||||
|
||||
rule = AlertRule(
|
||||
id=_new_id(),
|
||||
name=body.name,
|
||||
description=body.description,
|
||||
analyzer=body.analyzer,
|
||||
config=body.config,
|
||||
severity_override=body.severity_override,
|
||||
enabled=body.enabled,
|
||||
hunt_id=body.hunt_id,
|
||||
)
|
||||
db.add(rule)
|
||||
await db.commit()
|
||||
await db.refresh(rule)
|
||||
return _rule_to_dict(rule)
|
||||
|
||||
|
||||
@router.put("/rules/{rule_id}", summary="Update alert rule")
|
||||
async def update_rule(
|
||||
rule_id: str, body: RuleUpdate, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
rule = await db.get(AlertRule, rule_id)
|
||||
if not rule:
|
||||
raise HTTPException(status_code=404, detail="Rule not found")
|
||||
|
||||
if body.name is not None:
|
||||
rule.name = body.name
|
||||
if body.description is not None:
|
||||
rule.description = body.description
|
||||
if body.config is not None:
|
||||
rule.config = body.config
|
||||
if body.severity_override is not None:
|
||||
rule.severity_override = body.severity_override
|
||||
if body.enabled is not None:
|
||||
rule.enabled = body.enabled
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(rule)
|
||||
return _rule_to_dict(rule)
|
||||
|
||||
|
||||
@router.delete("/rules/{rule_id}", summary="Delete alert rule")
|
||||
async def delete_rule(rule_id: str, db: AsyncSession = Depends(get_db)):
|
||||
rule = await db.get(AlertRule, rule_id)
|
||||
if not rule:
|
||||
raise HTTPException(status_code=404, detail="Rule not found")
|
||||
await db.delete(rule)
|
||||
await db.commit()
|
||||
return {"ok": True}
|
||||
@@ -1,371 +1,296 @@
|
||||
"""Analysis API routes - triage, host profiles, reports, IOC extraction,
|
||||
host grouping, anomaly detection, data query (SSE), and job management."""
|
||||
|
||||
from __future__ import annotations
|
||||
"""API routes for process trees, storyline graphs, risk scoring, LLM analysis, timeline, and field stats."""
|
||||
|
||||
import logging
|
||||
from typing import Optional
|
||||
from typing import Any, Optional
|
||||
|
||||
from fastapi import APIRouter, BackgroundTasks, Depends, HTTPException, Query
|
||||
from fastapi.responses import StreamingResponse
|
||||
from pydantic import BaseModel
|
||||
from sqlalchemy import select
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query, Body
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db import get_db
|
||||
from app.db.models import HostProfile, HuntReport, TriageResult
|
||||
from app.db.repositories.datasets import DatasetRepository
|
||||
from app.services.process_tree import (
|
||||
build_process_tree,
|
||||
build_storyline,
|
||||
compute_risk_scores,
|
||||
_fetch_rows,
|
||||
)
|
||||
from app.services.llm_analysis import (
|
||||
AnalysisRequest,
|
||||
AnalysisResult,
|
||||
run_llm_analysis,
|
||||
)
|
||||
from app.services.timeline import (
|
||||
build_timeline_bins,
|
||||
compute_field_stats,
|
||||
search_rows,
|
||||
)
|
||||
from app.services.mitre import (
|
||||
map_to_attack,
|
||||
build_knowledge_graph,
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/analysis", tags=["analysis"])
|
||||
|
||||
|
||||
# --- Response models ---
|
||||
|
||||
class TriageResultResponse(BaseModel):
|
||||
id: str
|
||||
dataset_id: str
|
||||
row_start: int
|
||||
row_end: int
|
||||
risk_score: float
|
||||
verdict: str
|
||||
findings: list | None = None
|
||||
suspicious_indicators: list | None = None
|
||||
mitre_techniques: list | None = None
|
||||
model_used: str | None = None
|
||||
node_used: str | None = None
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
# ── Response models ───────────────────────────────────────────────────
|
||||
|
||||
|
||||
class HostProfileResponse(BaseModel):
|
||||
id: str
|
||||
hunt_id: str
|
||||
class ProcessTreeResponse(BaseModel):
|
||||
trees: list[dict] = Field(default_factory=list)
|
||||
total_processes: int = 0
|
||||
|
||||
|
||||
class StorylineResponse(BaseModel):
|
||||
nodes: list[dict] = Field(default_factory=list)
|
||||
edges: list[dict] = Field(default_factory=list)
|
||||
summary: dict = Field(default_factory=dict)
|
||||
|
||||
|
||||
class RiskHostEntry(BaseModel):
|
||||
hostname: str
|
||||
fqdn: str | None = None
|
||||
risk_score: float
|
||||
risk_level: str
|
||||
artifact_summary: dict | None = None
|
||||
timeline_summary: str | None = None
|
||||
suspicious_findings: list | None = None
|
||||
mitre_techniques: list | None = None
|
||||
llm_analysis: str | None = None
|
||||
model_used: str | None = None
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
score: int = 0
|
||||
signals: list[str] = Field(default_factory=list)
|
||||
event_count: int = 0
|
||||
process_count: int = 0
|
||||
network_count: int = 0
|
||||
file_count: int = 0
|
||||
|
||||
|
||||
class HuntReportResponse(BaseModel):
|
||||
id: str
|
||||
hunt_id: str
|
||||
status: str
|
||||
exec_summary: str | None = None
|
||||
full_report: str | None = None
|
||||
findings: list | None = None
|
||||
recommendations: list | None = None
|
||||
mitre_mapping: dict | None = None
|
||||
ioc_table: list | None = None
|
||||
host_risk_summary: list | None = None
|
||||
models_used: list | None = None
|
||||
generation_time_ms: int | None = None
|
||||
|
||||
class Config:
|
||||
from_attributes = True
|
||||
class RiskSummaryResponse(BaseModel):
|
||||
hosts: list[RiskHostEntry] = Field(default_factory=list)
|
||||
overall_score: int = 0
|
||||
total_events: int = 0
|
||||
severity_breakdown: dict[str, int] = Field(default_factory=dict)
|
||||
|
||||
|
||||
class QueryRequest(BaseModel):
|
||||
question: str
|
||||
mode: str = "quick" # quick or deep
|
||||
# ── Routes ────────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
# --- Triage endpoints ---
|
||||
|
||||
@router.get("/triage/{dataset_id}", response_model=list[TriageResultResponse])
|
||||
async def get_triage_results(
|
||||
dataset_id: str,
|
||||
min_risk: float = Query(0.0, ge=0.0, le=10.0),
|
||||
@router.get(
|
||||
"/process-tree",
|
||||
response_model=ProcessTreeResponse,
|
||||
summary="Build process tree from dataset rows",
|
||||
description=(
|
||||
"Extracts parent→child process relationships from dataset rows "
|
||||
"and returns a hierarchical forest of process nodes."
|
||||
),
|
||||
)
|
||||
async def get_process_tree(
|
||||
dataset_id: str | None = Query(None, description="Dataset ID"),
|
||||
hunt_id: str | None = Query(None, description="Hunt ID (scans all datasets in hunt)"),
|
||||
hostname: str | None = Query(None, description="Filter by hostname"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
result = await db.execute(
|
||||
select(TriageResult)
|
||||
.where(TriageResult.dataset_id == dataset_id)
|
||||
.where(TriageResult.risk_score >= min_risk)
|
||||
.order_by(TriageResult.risk_score.desc())
|
||||
"""Return process tree(s) for a dataset or hunt."""
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
|
||||
trees = await build_process_tree(
|
||||
db, dataset_id=dataset_id, hunt_id=hunt_id, hostname_filter=hostname,
|
||||
)
|
||||
return result.scalars().all()
|
||||
|
||||
# Count total processes recursively
|
||||
def _count(node: dict) -> int:
|
||||
return 1 + sum(_count(c) for c in node.get("children", []))
|
||||
|
||||
total = sum(_count(t) for t in trees)
|
||||
|
||||
return ProcessTreeResponse(trees=trees, total_processes=total)
|
||||
|
||||
|
||||
@router.post("/triage/{dataset_id}")
|
||||
async def trigger_triage(
|
||||
dataset_id: str,
|
||||
background_tasks: BackgroundTasks,
|
||||
):
|
||||
async def _run():
|
||||
from app.services.triage import triage_dataset
|
||||
await triage_dataset(dataset_id)
|
||||
|
||||
background_tasks.add_task(_run)
|
||||
return {"status": "triage_started", "dataset_id": dataset_id}
|
||||
|
||||
|
||||
# --- Host profile endpoints ---
|
||||
|
||||
@router.get("/profiles/{hunt_id}", response_model=list[HostProfileResponse])
|
||||
async def get_host_profiles(
|
||||
hunt_id: str,
|
||||
min_risk: float = Query(0.0, ge=0.0, le=10.0),
|
||||
@router.get(
|
||||
"/storyline",
|
||||
response_model=StorylineResponse,
|
||||
summary="Build CrowdStrike-style storyline attack graph",
|
||||
description=(
|
||||
"Creates a Cytoscape-compatible graph of events connected by "
|
||||
"process lineage (spawned) and temporal sequence within each host."
|
||||
),
|
||||
)
|
||||
async def get_storyline(
|
||||
dataset_id: str | None = Query(None, description="Dataset ID"),
|
||||
hunt_id: str | None = Query(None, description="Hunt ID (scans all datasets in hunt)"),
|
||||
hostname: str | None = Query(None, description="Filter by hostname"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
result = await db.execute(
|
||||
select(HostProfile)
|
||||
.where(HostProfile.hunt_id == hunt_id)
|
||||
.where(HostProfile.risk_score >= min_risk)
|
||||
.order_by(HostProfile.risk_score.desc())
|
||||
"""Return a storyline graph for a dataset or hunt."""
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
|
||||
result = await build_storyline(
|
||||
db, dataset_id=dataset_id, hunt_id=hunt_id, hostname_filter=hostname,
|
||||
)
|
||||
return result.scalars().all()
|
||||
|
||||
return StorylineResponse(**result)
|
||||
|
||||
|
||||
@router.post("/profiles/{hunt_id}")
|
||||
async def trigger_all_profiles(
|
||||
hunt_id: str,
|
||||
background_tasks: BackgroundTasks,
|
||||
):
|
||||
async def _run():
|
||||
from app.services.host_profiler import profile_all_hosts
|
||||
await profile_all_hosts(hunt_id)
|
||||
|
||||
background_tasks.add_task(_run)
|
||||
return {"status": "profiling_started", "hunt_id": hunt_id}
|
||||
|
||||
|
||||
@router.post("/profiles/{hunt_id}/{hostname}")
|
||||
async def trigger_single_profile(
|
||||
hunt_id: str,
|
||||
hostname: str,
|
||||
background_tasks: BackgroundTasks,
|
||||
):
|
||||
async def _run():
|
||||
from app.services.host_profiler import profile_host
|
||||
await profile_host(hunt_id, hostname)
|
||||
|
||||
background_tasks.add_task(_run)
|
||||
return {"status": "profiling_started", "hunt_id": hunt_id, "hostname": hostname}
|
||||
|
||||
|
||||
# --- Report endpoints ---
|
||||
|
||||
@router.get("/reports/{hunt_id}", response_model=list[HuntReportResponse])
|
||||
async def list_reports(
|
||||
hunt_id: str,
|
||||
@router.get(
|
||||
"/risk-summary",
|
||||
response_model=RiskSummaryResponse,
|
||||
summary="Compute risk scores per host",
|
||||
description=(
|
||||
"Analyzes dataset rows for suspicious patterns (encoded PowerShell, "
|
||||
"credential dumping, lateral movement) and produces per-host risk scores."
|
||||
),
|
||||
)
|
||||
async def get_risk_summary(
|
||||
hunt_id: str | None = Query(None, description="Hunt ID"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
result = await db.execute(
|
||||
select(HuntReport)
|
||||
.where(HuntReport.hunt_id == hunt_id)
|
||||
.order_by(HuntReport.created_at.desc())
|
||||
"""Return risk scores for all hosts in a hunt."""
|
||||
result = await compute_risk_scores(db, hunt_id=hunt_id)
|
||||
return RiskSummaryResponse(**result)
|
||||
|
||||
|
||||
# ── LLM Analysis ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.post(
|
||||
"/llm-analyze",
|
||||
response_model=AnalysisResult,
|
||||
summary="Run LLM-powered threat analysis on dataset",
|
||||
description=(
|
||||
"Loads dataset rows server-side, builds a summary, and sends to "
|
||||
"Wile (deep analysis) or Roadrunner (quick) for comprehensive "
|
||||
"threat analysis. Returns structured findings, IOCs, MITRE techniques."
|
||||
),
|
||||
)
|
||||
async def llm_analyze(
|
||||
request: AnalysisRequest,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Run LLM analysis on a dataset or hunt."""
|
||||
if not request.dataset_id and not request.hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
|
||||
# Load rows
|
||||
rows_objs = await _fetch_rows(
|
||||
db,
|
||||
dataset_id=request.dataset_id,
|
||||
hunt_id=request.hunt_id,
|
||||
limit=2000,
|
||||
)
|
||||
return result.scalars().all()
|
||||
|
||||
if not rows_objs:
|
||||
raise HTTPException(status_code=404, detail="No rows found for analysis")
|
||||
|
||||
# Extract data dicts
|
||||
rows = [r.normalized_data or r.data for r in rows_objs]
|
||||
|
||||
# Get dataset name
|
||||
ds_name = "hunt datasets"
|
||||
if request.dataset_id:
|
||||
repo = DatasetRepository(db)
|
||||
ds = await repo.get_dataset(request.dataset_id)
|
||||
if ds:
|
||||
ds_name = ds.name
|
||||
|
||||
result = await run_llm_analysis(rows, request, dataset_name=ds_name)
|
||||
return result
|
||||
|
||||
|
||||
@router.get("/reports/{hunt_id}/{report_id}", response_model=HuntReportResponse)
|
||||
async def get_report(
|
||||
hunt_id: str,
|
||||
report_id: str,
|
||||
# ── Timeline ──────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get(
|
||||
"/timeline",
|
||||
summary="Get event timeline histogram bins",
|
||||
)
|
||||
async def get_timeline(
|
||||
dataset_id: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
bins: int = Query(60, ge=10, le=200),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
result = await db.execute(
|
||||
select(HuntReport)
|
||||
.where(HuntReport.id == report_id)
|
||||
.where(HuntReport.hunt_id == hunt_id)
|
||||
)
|
||||
report = result.scalar_one_or_none()
|
||||
if not report:
|
||||
raise HTTPException(status_code=404, detail="Report not found")
|
||||
return report
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
return await build_timeline_bins(db, dataset_id=dataset_id, hunt_id=hunt_id, bins=bins)
|
||||
|
||||
|
||||
@router.post("/reports/{hunt_id}/generate")
|
||||
async def trigger_report(
|
||||
hunt_id: str,
|
||||
background_tasks: BackgroundTasks,
|
||||
):
|
||||
async def _run():
|
||||
from app.services.report_generator import generate_report
|
||||
await generate_report(hunt_id)
|
||||
|
||||
background_tasks.add_task(_run)
|
||||
return {"status": "report_generation_started", "hunt_id": hunt_id}
|
||||
|
||||
|
||||
# --- IOC extraction endpoints ---
|
||||
|
||||
@router.get("/iocs/{dataset_id}")
|
||||
async def extract_iocs(
|
||||
dataset_id: str,
|
||||
max_rows: int = Query(5000, ge=1, le=50000),
|
||||
@router.get(
|
||||
"/field-stats",
|
||||
summary="Get per-field value distributions",
|
||||
)
|
||||
async def get_field_stats(
|
||||
dataset_id: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
fields: str | None = Query(None, description="Comma-separated field names"),
|
||||
top_n: int = Query(20, ge=5, le=100),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Extract IOCs (IPs, domains, hashes, etc.) from dataset rows."""
|
||||
from app.services.ioc_extractor import extract_iocs_from_dataset
|
||||
iocs = await extract_iocs_from_dataset(dataset_id, db, max_rows=max_rows)
|
||||
total = sum(len(v) for v in iocs.values())
|
||||
return {"dataset_id": dataset_id, "iocs": iocs, "total": total}
|
||||
|
||||
|
||||
# --- Host grouping endpoints ---
|
||||
|
||||
@router.get("/hosts/{hunt_id}")
|
||||
async def get_host_groups(
|
||||
hunt_id: str,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Group data by hostname across all datasets in a hunt."""
|
||||
from app.services.ioc_extractor import extract_host_groups
|
||||
groups = await extract_host_groups(hunt_id, db)
|
||||
return {"hunt_id": hunt_id, "hosts": groups}
|
||||
|
||||
|
||||
# --- Anomaly detection endpoints ---
|
||||
|
||||
@router.get("/anomalies/{dataset_id}")
|
||||
async def get_anomalies(
|
||||
dataset_id: str,
|
||||
outliers_only: bool = Query(False),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Get anomaly detection results for a dataset."""
|
||||
from app.db.models import AnomalyResult
|
||||
stmt = select(AnomalyResult).where(AnomalyResult.dataset_id == dataset_id)
|
||||
if outliers_only:
|
||||
stmt = stmt.where(AnomalyResult.is_outlier == True)
|
||||
stmt = stmt.order_by(AnomalyResult.anomaly_score.desc())
|
||||
result = await db.execute(stmt)
|
||||
rows = result.scalars().all()
|
||||
return [
|
||||
{
|
||||
"id": r.id,
|
||||
"dataset_id": r.dataset_id,
|
||||
"row_id": r.row_id,
|
||||
"anomaly_score": r.anomaly_score,
|
||||
"distance_from_centroid": r.distance_from_centroid,
|
||||
"cluster_id": r.cluster_id,
|
||||
"is_outlier": r.is_outlier,
|
||||
"explanation": r.explanation,
|
||||
}
|
||||
for r in rows
|
||||
]
|
||||
|
||||
|
||||
@router.post("/anomalies/{dataset_id}")
|
||||
async def trigger_anomaly_detection(
|
||||
dataset_id: str,
|
||||
k: int = Query(3, ge=2, le=20),
|
||||
threshold: float = Query(0.35, ge=0.1, le=0.9),
|
||||
background_tasks: BackgroundTasks = None,
|
||||
):
|
||||
"""Trigger embedding-based anomaly detection on a dataset."""
|
||||
async def _run():
|
||||
from app.services.anomaly_detector import detect_anomalies
|
||||
await detect_anomalies(dataset_id, k=k, outlier_threshold=threshold)
|
||||
|
||||
if background_tasks:
|
||||
background_tasks.add_task(_run)
|
||||
return {"status": "anomaly_detection_started", "dataset_id": dataset_id}
|
||||
else:
|
||||
from app.services.anomaly_detector import detect_anomalies
|
||||
results = await detect_anomalies(dataset_id, k=k, outlier_threshold=threshold)
|
||||
return {"status": "complete", "dataset_id": dataset_id, "count": len(results)}
|
||||
|
||||
|
||||
# --- Natural language data query (SSE streaming) ---
|
||||
|
||||
@router.post("/query/{dataset_id}")
|
||||
async def query_dataset_endpoint(
|
||||
dataset_id: str,
|
||||
body: QueryRequest,
|
||||
):
|
||||
"""Ask a natural language question about a dataset.
|
||||
|
||||
Returns an SSE stream with token-by-token LLM response.
|
||||
Event types: status, metadata, token, error, done
|
||||
"""
|
||||
from app.services.data_query import query_dataset_stream
|
||||
|
||||
return StreamingResponse(
|
||||
query_dataset_stream(dataset_id, body.question, body.mode),
|
||||
media_type="text/event-stream",
|
||||
headers={
|
||||
"Cache-Control": "no-cache",
|
||||
"Connection": "keep-alive",
|
||||
"X-Accel-Buffering": "no",
|
||||
},
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
field_list = [f.strip() for f in fields.split(",")] if fields else None
|
||||
return await compute_field_stats(
|
||||
db, dataset_id=dataset_id, hunt_id=hunt_id,
|
||||
fields=field_list, top_n=top_n,
|
||||
)
|
||||
|
||||
|
||||
@router.post("/query/{dataset_id}/sync")
|
||||
async def query_dataset_sync(
|
||||
dataset_id: str,
|
||||
body: QueryRequest,
|
||||
class SearchRequest(BaseModel):
|
||||
dataset_id: Optional[str] = None
|
||||
hunt_id: Optional[str] = None
|
||||
query: str = ""
|
||||
filters: dict[str, str] = Field(default_factory=dict)
|
||||
time_start: Optional[str] = None
|
||||
time_end: Optional[str] = None
|
||||
limit: int = 500
|
||||
offset: int = 0
|
||||
|
||||
|
||||
@router.post(
|
||||
"/search",
|
||||
summary="Search and filter dataset rows",
|
||||
)
|
||||
async def search_dataset_rows(
|
||||
request: SearchRequest,
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Non-streaming version of data query."""
|
||||
from app.services.data_query import query_dataset
|
||||
|
||||
try:
|
||||
answer = await query_dataset(dataset_id, body.question, body.mode)
|
||||
return {"dataset_id": dataset_id, "question": body.question, "answer": answer, "mode": body.mode}
|
||||
except ValueError as e:
|
||||
raise HTTPException(status_code=404, detail=str(e))
|
||||
except Exception as e:
|
||||
logger.error(f"Query failed: {e}", exc_info=True)
|
||||
raise HTTPException(status_code=500, detail=str(e))
|
||||
if not request.dataset_id and not request.hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
return await search_rows(
|
||||
db,
|
||||
dataset_id=request.dataset_id,
|
||||
hunt_id=request.hunt_id,
|
||||
query=request.query,
|
||||
filters=request.filters,
|
||||
time_start=request.time_start,
|
||||
time_end=request.time_end,
|
||||
limit=request.limit,
|
||||
offset=request.offset,
|
||||
)
|
||||
|
||||
|
||||
# --- Job queue endpoints ---
|
||||
# ── MITRE ATT&CK ─────────────────────────────────────────────────────
|
||||
|
||||
@router.get("/jobs")
|
||||
async def list_jobs(
|
||||
status: str | None = Query(None),
|
||||
job_type: str | None = Query(None),
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
|
||||
@router.get(
|
||||
"/mitre-map",
|
||||
summary="Map dataset events to MITRE ATT&CK techniques",
|
||||
)
|
||||
async def get_mitre_map(
|
||||
dataset_id: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""List all tracked jobs."""
|
||||
from app.services.job_queue import job_queue, JobStatus, JobType
|
||||
|
||||
s = JobStatus(status) if status else None
|
||||
t = JobType(job_type) if job_type else None
|
||||
jobs = job_queue.list_jobs(status=s, job_type=t, limit=limit)
|
||||
stats = job_queue.get_stats()
|
||||
return {"jobs": jobs, "stats": stats}
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
return await map_to_attack(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
|
||||
|
||||
@router.get("/jobs/{job_id}")
|
||||
async def get_job(job_id: str):
|
||||
"""Get status of a specific job."""
|
||||
from app.services.job_queue import job_queue
|
||||
|
||||
job = job_queue.get_job(job_id)
|
||||
if not job:
|
||||
raise HTTPException(status_code=404, detail="Job not found")
|
||||
return job.to_dict()
|
||||
|
||||
|
||||
@router.delete("/jobs/{job_id}")
|
||||
async def cancel_job(job_id: str):
|
||||
"""Cancel a running or queued job."""
|
||||
from app.services.job_queue import job_queue
|
||||
|
||||
if job_queue.cancel_job(job_id):
|
||||
return {"status": "cancelled", "job_id": job_id}
|
||||
raise HTTPException(status_code=400, detail="Job cannot be cancelled (already complete or not found)")
|
||||
|
||||
|
||||
@router.post("/jobs/submit/{job_type}")
|
||||
async def submit_job(
|
||||
job_type: str,
|
||||
params: dict = {},
|
||||
@router.get(
|
||||
"/knowledge-graph",
|
||||
summary="Build entity-technique knowledge graph",
|
||||
)
|
||||
async def get_knowledge_graph(
|
||||
dataset_id: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
<<<<<<< HEAD
|
||||
"""Submit a new job to the queue.
|
||||
|
||||
Job types: triage, host_profile, report, anomaly, query
|
||||
@@ -403,4 +328,9 @@ async def lb_health_check():
|
||||
"""Force a health check of both nodes."""
|
||||
from app.services.load_balancer import lb
|
||||
await lb.check_health()
|
||||
return lb.get_status()
|
||||
return lb.get_status()
|
||||
=======
|
||||
if not dataset_id and not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="Provide dataset_id or hunt_id")
|
||||
return await build_knowledge_graph(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
296
backend/app/api/routes/cases.py
Normal file
296
backend/app/api/routes/cases.py
Normal file
@@ -0,0 +1,296 @@
|
||||
"""API routes for case management — CRUD for cases, tasks, and activity logs."""
|
||||
|
||||
import logging
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select, func, desc
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db import get_db
|
||||
from app.db.models import Case, CaseTask, ActivityLog, _new_id, _utcnow
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/cases", tags=["cases"])
|
||||
|
||||
|
||||
# ── Pydantic models ──────────────────────────────────────────────────
|
||||
|
||||
class CaseCreate(BaseModel):
|
||||
title: str
|
||||
description: Optional[str] = None
|
||||
severity: str = "medium"
|
||||
tlp: str = "amber"
|
||||
pap: str = "amber"
|
||||
priority: int = 2
|
||||
assignee: Optional[str] = None
|
||||
tags: Optional[list[str]] = None
|
||||
hunt_id: Optional[str] = None
|
||||
mitre_techniques: Optional[list[str]] = None
|
||||
iocs: Optional[list[dict]] = None
|
||||
|
||||
|
||||
class CaseUpdate(BaseModel):
|
||||
title: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
severity: Optional[str] = None
|
||||
tlp: Optional[str] = None
|
||||
pap: Optional[str] = None
|
||||
status: Optional[str] = None
|
||||
priority: Optional[int] = None
|
||||
assignee: Optional[str] = None
|
||||
tags: Optional[list[str]] = None
|
||||
mitre_techniques: Optional[list[str]] = None
|
||||
iocs: Optional[list[dict]] = None
|
||||
|
||||
|
||||
class TaskCreate(BaseModel):
|
||||
title: str
|
||||
description: Optional[str] = None
|
||||
assignee: Optional[str] = None
|
||||
|
||||
|
||||
class TaskUpdate(BaseModel):
|
||||
title: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
status: Optional[str] = None
|
||||
assignee: Optional[str] = None
|
||||
order: Optional[int] = None
|
||||
|
||||
|
||||
# ── Helper: log activity ─────────────────────────────────────────────
|
||||
|
||||
async def _log_activity(
|
||||
db: AsyncSession,
|
||||
entity_type: str,
|
||||
entity_id: str,
|
||||
action: str,
|
||||
details: dict | None = None,
|
||||
):
|
||||
log = ActivityLog(
|
||||
entity_type=entity_type,
|
||||
entity_id=entity_id,
|
||||
action=action,
|
||||
details=details,
|
||||
created_at=_utcnow(),
|
||||
)
|
||||
db.add(log)
|
||||
|
||||
|
||||
# ── Case CRUD ─────────────────────────────────────────────────────────
|
||||
|
||||
@router.post("", summary="Create a case")
|
||||
async def create_case(body: CaseCreate, db: AsyncSession = Depends(get_db)):
|
||||
now = _utcnow()
|
||||
case = Case(
|
||||
id=_new_id(),
|
||||
title=body.title,
|
||||
description=body.description,
|
||||
severity=body.severity,
|
||||
tlp=body.tlp,
|
||||
pap=body.pap,
|
||||
priority=body.priority,
|
||||
assignee=body.assignee,
|
||||
tags=body.tags,
|
||||
hunt_id=body.hunt_id,
|
||||
mitre_techniques=body.mitre_techniques,
|
||||
iocs=body.iocs,
|
||||
created_at=now,
|
||||
updated_at=now,
|
||||
)
|
||||
db.add(case)
|
||||
await _log_activity(db, "case", case.id, "created", {"title": body.title})
|
||||
await db.commit()
|
||||
await db.refresh(case)
|
||||
return _case_to_dict(case)
|
||||
|
||||
|
||||
@router.get("", summary="List cases")
|
||||
async def list_cases(
|
||||
status: Optional[str] = Query(None),
|
||||
hunt_id: Optional[str] = Query(None),
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
offset: int = Query(0, ge=0),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
q = select(Case).order_by(desc(Case.updated_at))
|
||||
if status:
|
||||
q = q.where(Case.status == status)
|
||||
if hunt_id:
|
||||
q = q.where(Case.hunt_id == hunt_id)
|
||||
q = q.offset(offset).limit(limit)
|
||||
result = await db.execute(q)
|
||||
cases = result.scalars().all()
|
||||
|
||||
count_q = select(func.count(Case.id))
|
||||
if status:
|
||||
count_q = count_q.where(Case.status == status)
|
||||
if hunt_id:
|
||||
count_q = count_q.where(Case.hunt_id == hunt_id)
|
||||
total = (await db.execute(count_q)).scalar() or 0
|
||||
|
||||
return {"cases": [_case_to_dict(c) for c in cases], "total": total}
|
||||
|
||||
|
||||
@router.get("/{case_id}", summary="Get case detail")
|
||||
async def get_case(case_id: str, db: AsyncSession = Depends(get_db)):
|
||||
case = await db.get(Case, case_id)
|
||||
if not case:
|
||||
raise HTTPException(status_code=404, detail="Case not found")
|
||||
return _case_to_dict(case)
|
||||
|
||||
|
||||
@router.put("/{case_id}", summary="Update a case")
|
||||
async def update_case(case_id: str, body: CaseUpdate, db: AsyncSession = Depends(get_db)):
|
||||
case = await db.get(Case, case_id)
|
||||
if not case:
|
||||
raise HTTPException(status_code=404, detail="Case not found")
|
||||
changes = {}
|
||||
for field in ["title", "description", "severity", "tlp", "pap", "status",
|
||||
"priority", "assignee", "tags", "mitre_techniques", "iocs"]:
|
||||
val = getattr(body, field)
|
||||
if val is not None:
|
||||
old = getattr(case, field)
|
||||
setattr(case, field, val)
|
||||
changes[field] = {"old": old, "new": val}
|
||||
if "status" in changes and changes["status"]["new"] == "in-progress" and not case.started_at:
|
||||
case.started_at = _utcnow()
|
||||
if "status" in changes and changes["status"]["new"] in ("resolved", "closed"):
|
||||
case.resolved_at = _utcnow()
|
||||
case.updated_at = _utcnow()
|
||||
await _log_activity(db, "case", case.id, "updated", changes)
|
||||
await db.commit()
|
||||
await db.refresh(case)
|
||||
return _case_to_dict(case)
|
||||
|
||||
|
||||
@router.delete("/{case_id}", summary="Delete a case")
|
||||
async def delete_case(case_id: str, db: AsyncSession = Depends(get_db)):
|
||||
case = await db.get(Case, case_id)
|
||||
if not case:
|
||||
raise HTTPException(status_code=404, detail="Case not found")
|
||||
await db.delete(case)
|
||||
await db.commit()
|
||||
return {"deleted": True}
|
||||
|
||||
|
||||
# ── Task CRUD ─────────────────────────────────────────────────────────
|
||||
|
||||
@router.post("/{case_id}/tasks", summary="Add task to case")
|
||||
async def create_task(case_id: str, body: TaskCreate, db: AsyncSession = Depends(get_db)):
|
||||
case = await db.get(Case, case_id)
|
||||
if not case:
|
||||
raise HTTPException(status_code=404, detail="Case not found")
|
||||
now = _utcnow()
|
||||
task = CaseTask(
|
||||
id=_new_id(),
|
||||
case_id=case_id,
|
||||
title=body.title,
|
||||
description=body.description,
|
||||
assignee=body.assignee,
|
||||
created_at=now,
|
||||
updated_at=now,
|
||||
)
|
||||
db.add(task)
|
||||
await _log_activity(db, "case", case_id, "task_created", {"title": body.title})
|
||||
await db.commit()
|
||||
await db.refresh(task)
|
||||
return _task_to_dict(task)
|
||||
|
||||
|
||||
@router.put("/{case_id}/tasks/{task_id}", summary="Update a task")
|
||||
async def update_task(case_id: str, task_id: str, body: TaskUpdate, db: AsyncSession = Depends(get_db)):
|
||||
task = await db.get(CaseTask, task_id)
|
||||
if not task or task.case_id != case_id:
|
||||
raise HTTPException(status_code=404, detail="Task not found")
|
||||
for field in ["title", "description", "status", "assignee", "order"]:
|
||||
val = getattr(body, field)
|
||||
if val is not None:
|
||||
setattr(task, field, val)
|
||||
task.updated_at = _utcnow()
|
||||
await _log_activity(db, "case", case_id, "task_updated", {"task_id": task_id})
|
||||
await db.commit()
|
||||
await db.refresh(task)
|
||||
return _task_to_dict(task)
|
||||
|
||||
|
||||
@router.delete("/{case_id}/tasks/{task_id}", summary="Delete a task")
|
||||
async def delete_task(case_id: str, task_id: str, db: AsyncSession = Depends(get_db)):
|
||||
task = await db.get(CaseTask, task_id)
|
||||
if not task or task.case_id != case_id:
|
||||
raise HTTPException(status_code=404, detail="Task not found")
|
||||
await db.delete(task)
|
||||
await db.commit()
|
||||
return {"deleted": True}
|
||||
|
||||
|
||||
# ── Activity Log ──────────────────────────────────────────────────────
|
||||
|
||||
@router.get("/{case_id}/activity", summary="Get case activity log")
|
||||
async def get_activity(
|
||||
case_id: str,
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
q = (
|
||||
select(ActivityLog)
|
||||
.where(ActivityLog.entity_type == "case", ActivityLog.entity_id == case_id)
|
||||
.order_by(desc(ActivityLog.created_at))
|
||||
.limit(limit)
|
||||
)
|
||||
result = await db.execute(q)
|
||||
logs = result.scalars().all()
|
||||
return {
|
||||
"logs": [
|
||||
{
|
||||
"id": l.id,
|
||||
"action": l.action,
|
||||
"details": l.details,
|
||||
"user_id": l.user_id,
|
||||
"created_at": l.created_at.isoformat() if l.created_at else None,
|
||||
}
|
||||
for l in logs
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
# ── Helpers ───────────────────────────────────────────────────────────
|
||||
|
||||
def _case_to_dict(c: Case) -> dict:
|
||||
return {
|
||||
"id": c.id,
|
||||
"title": c.title,
|
||||
"description": c.description,
|
||||
"severity": c.severity,
|
||||
"tlp": c.tlp,
|
||||
"pap": c.pap,
|
||||
"status": c.status,
|
||||
"priority": c.priority,
|
||||
"assignee": c.assignee,
|
||||
"tags": c.tags or [],
|
||||
"hunt_id": c.hunt_id,
|
||||
"owner_id": c.owner_id,
|
||||
"mitre_techniques": c.mitre_techniques or [],
|
||||
"iocs": c.iocs or [],
|
||||
"started_at": c.started_at.isoformat() if c.started_at else None,
|
||||
"resolved_at": c.resolved_at.isoformat() if c.resolved_at else None,
|
||||
"created_at": c.created_at.isoformat() if c.created_at else None,
|
||||
"updated_at": c.updated_at.isoformat() if c.updated_at else None,
|
||||
"tasks": [_task_to_dict(t) for t in (c.tasks or [])],
|
||||
}
|
||||
|
||||
|
||||
def _task_to_dict(t: CaseTask) -> dict:
|
||||
return {
|
||||
"id": t.id,
|
||||
"case_id": t.case_id,
|
||||
"title": t.title,
|
||||
"description": t.description,
|
||||
"status": t.status,
|
||||
"assignee": t.assignee,
|
||||
"order": t.order,
|
||||
"created_at": t.created_at.isoformat() if t.created_at else None,
|
||||
"updated_at": t.updated_at.isoformat() if t.updated_at else None,
|
||||
}
|
||||
@@ -398,3 +398,30 @@ async def delete_dataset(
|
||||
raise HTTPException(status_code=404, detail="Dataset not found")
|
||||
keyword_scan_cache.invalidate_dataset(dataset_id)
|
||||
return {"message": "Dataset deleted", "id": dataset_id}
|
||||
|
||||
|
||||
@router.post(
|
||||
"/rescan-ioc",
|
||||
summary="Re-scan IOC columns for all datasets",
|
||||
)
|
||||
async def rescan_ioc_columns(
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Re-run detect_ioc_columns on every dataset using current detection logic."""
|
||||
repo = DatasetRepository(db)
|
||||
all_ds = await repo.list_datasets(limit=10000)
|
||||
updated = 0
|
||||
for ds in all_ds:
|
||||
columns = list((ds.column_schema or {}).keys())
|
||||
if not columns:
|
||||
continue
|
||||
new_ioc = detect_ioc_columns(
|
||||
columns,
|
||||
ds.column_schema or {},
|
||||
ds.normalized_columns or {},
|
||||
)
|
||||
if new_ioc != (ds.ioc_columns or {}):
|
||||
ds.ioc_columns = new_ioc
|
||||
updated += 1
|
||||
await db.commit()
|
||||
return {"message": f"Rescanned {len(all_ds)} datasets, updated {updated}"}
|
||||
|
||||
@@ -1,20 +1,34 @@
|
||||
<<<<<<< HEAD
|
||||
"""Network topology API - host inventory endpoint with background caching."""
|
||||
=======
|
||||
"""API routes for Network Picture — deduplicated host inventory."""
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
import logging
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
<<<<<<< HEAD
|
||||
from fastapi.responses import JSONResponse
|
||||
=======
|
||||
from pydantic import BaseModel, Field
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.config import settings
|
||||
from app.db import get_db
|
||||
<<<<<<< HEAD
|
||||
from app.services.host_inventory import build_host_inventory, inventory_cache
|
||||
from app.services.job_queue import job_queue, JobType
|
||||
=======
|
||||
from app.services.network_inventory import build_network_picture
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/network", tags=["network"])
|
||||
|
||||
|
||||
<<<<<<< HEAD
|
||||
@router.get("/host-inventory")
|
||||
async def get_host_inventory(
|
||||
hunt_id: str = Query(..., description="Hunt ID to build inventory for"),
|
||||
@@ -173,3 +187,58 @@ async def trigger_rebuild(
|
||||
inventory_cache.invalidate(hunt_id)
|
||||
job = job_queue.submit(JobType.HOST_INVENTORY, hunt_id=hunt_id)
|
||||
return {"job_id": job.id, "status": "queued"}
|
||||
=======
|
||||
# ── Response models ───────────────────────────────────────────────────
|
||||
|
||||
|
||||
class HostEntry(BaseModel):
|
||||
hostname: str
|
||||
ips: list[str] = Field(default_factory=list)
|
||||
users: list[str] = Field(default_factory=list)
|
||||
os: list[str] = Field(default_factory=list)
|
||||
mac_addresses: list[str] = Field(default_factory=list)
|
||||
protocols: list[str] = Field(default_factory=list)
|
||||
open_ports: list[str] = Field(default_factory=list)
|
||||
remote_targets: list[str] = Field(default_factory=list)
|
||||
datasets: list[str] = Field(default_factory=list)
|
||||
connection_count: int = 0
|
||||
first_seen: str | None = None
|
||||
last_seen: str | None = None
|
||||
|
||||
|
||||
class PictureSummary(BaseModel):
|
||||
total_hosts: int = 0
|
||||
total_connections: int = 0
|
||||
total_unique_ips: int = 0
|
||||
datasets_scanned: int = 0
|
||||
|
||||
|
||||
class NetworkPictureResponse(BaseModel):
|
||||
hosts: list[HostEntry]
|
||||
summary: PictureSummary
|
||||
|
||||
|
||||
# ── Routes ────────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get(
|
||||
"/picture",
|
||||
response_model=NetworkPictureResponse,
|
||||
summary="Build deduplicated host inventory for a hunt",
|
||||
description=(
|
||||
"Scans all datasets in the specified hunt, extracts host-identifying "
|
||||
"fields (hostname, IP, username, OS, MAC, ports), deduplicates by "
|
||||
"hostname, and returns a clean one-row-per-host network picture."
|
||||
),
|
||||
)
|
||||
async def get_network_picture(
|
||||
hunt_id: str = Query(..., description="Hunt ID to scan"),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
"""Return a deduplicated network picture for a hunt."""
|
||||
if not hunt_id:
|
||||
raise HTTPException(status_code=400, detail="hunt_id is required")
|
||||
|
||||
result = await build_network_picture(db, hunt_id)
|
||||
return result
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
360
backend/app/api/routes/notebooks.py
Normal file
360
backend/app/api/routes/notebooks.py
Normal file
@@ -0,0 +1,360 @@
|
||||
"""API routes for investigation notebooks and playbooks."""
|
||||
|
||||
import logging
|
||||
from typing import Optional
|
||||
|
||||
from fastapi import APIRouter, Depends, HTTPException, Query
|
||||
from pydantic import BaseModel, Field
|
||||
from sqlalchemy import select, func, desc
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db import get_db
|
||||
from app.db.models import Notebook, PlaybookRun, _new_id, _utcnow
|
||||
from app.services.playbook import (
|
||||
get_builtin_playbooks,
|
||||
get_playbook_template,
|
||||
validate_notebook_cells,
|
||||
)
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
router = APIRouter(prefix="/api/notebooks", tags=["notebooks"])
|
||||
|
||||
|
||||
# ── Pydantic models ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
class NotebookCreate(BaseModel):
|
||||
title: str
|
||||
description: Optional[str] = None
|
||||
cells: Optional[list[dict]] = None
|
||||
hunt_id: Optional[str] = None
|
||||
case_id: Optional[str] = None
|
||||
tags: Optional[list[str]] = None
|
||||
|
||||
|
||||
class NotebookUpdate(BaseModel):
|
||||
title: Optional[str] = None
|
||||
description: Optional[str] = None
|
||||
cells: Optional[list[dict]] = None
|
||||
tags: Optional[list[str]] = None
|
||||
|
||||
|
||||
class CellUpdate(BaseModel):
|
||||
"""Update a single cell or add a new one."""
|
||||
cell_id: str
|
||||
cell_type: Optional[str] = None
|
||||
source: Optional[str] = None
|
||||
output: Optional[str] = None
|
||||
metadata: Optional[dict] = None
|
||||
|
||||
|
||||
class PlaybookStart(BaseModel):
|
||||
playbook_name: str
|
||||
hunt_id: Optional[str] = None
|
||||
case_id: Optional[str] = None
|
||||
started_by: Optional[str] = None
|
||||
|
||||
|
||||
class StepComplete(BaseModel):
|
||||
notes: Optional[str] = None
|
||||
status: str = "completed" # completed | skipped
|
||||
|
||||
|
||||
# ── Helpers ───────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
def _notebook_to_dict(nb: Notebook) -> dict:
|
||||
return {
|
||||
"id": nb.id,
|
||||
"title": nb.title,
|
||||
"description": nb.description,
|
||||
"cells": nb.cells or [],
|
||||
"hunt_id": nb.hunt_id,
|
||||
"case_id": nb.case_id,
|
||||
"owner_id": nb.owner_id,
|
||||
"tags": nb.tags or [],
|
||||
"cell_count": len(nb.cells or []),
|
||||
"created_at": nb.created_at.isoformat() if nb.created_at else None,
|
||||
"updated_at": nb.updated_at.isoformat() if nb.updated_at else None,
|
||||
}
|
||||
|
||||
|
||||
def _run_to_dict(run: PlaybookRun) -> dict:
|
||||
return {
|
||||
"id": run.id,
|
||||
"playbook_name": run.playbook_name,
|
||||
"status": run.status,
|
||||
"current_step": run.current_step,
|
||||
"total_steps": run.total_steps,
|
||||
"step_results": run.step_results or [],
|
||||
"hunt_id": run.hunt_id,
|
||||
"case_id": run.case_id,
|
||||
"started_by": run.started_by,
|
||||
"created_at": run.created_at.isoformat() if run.created_at else None,
|
||||
"updated_at": run.updated_at.isoformat() if run.updated_at else None,
|
||||
"completed_at": run.completed_at.isoformat() if run.completed_at else None,
|
||||
}
|
||||
|
||||
|
||||
# ── Notebook CRUD ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get("", summary="List notebooks")
|
||||
async def list_notebooks(
|
||||
hunt_id: str | None = Query(None),
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
offset: int = Query(0, ge=0),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
stmt = select(Notebook)
|
||||
count_stmt = select(func.count(Notebook.id))
|
||||
if hunt_id:
|
||||
stmt = stmt.where(Notebook.hunt_id == hunt_id)
|
||||
count_stmt = count_stmt.where(Notebook.hunt_id == hunt_id)
|
||||
|
||||
total = (await db.execute(count_stmt)).scalar() or 0
|
||||
results = (await db.execute(
|
||||
stmt.order_by(desc(Notebook.updated_at)).offset(offset).limit(limit)
|
||||
)).scalars().all()
|
||||
|
||||
return {"notebooks": [_notebook_to_dict(n) for n in results], "total": total}
|
||||
|
||||
|
||||
@router.get("/{notebook_id}", summary="Get notebook")
|
||||
async def get_notebook(notebook_id: str, db: AsyncSession = Depends(get_db)):
|
||||
nb = await db.get(Notebook, notebook_id)
|
||||
if not nb:
|
||||
raise HTTPException(status_code=404, detail="Notebook not found")
|
||||
return _notebook_to_dict(nb)
|
||||
|
||||
|
||||
@router.post("", summary="Create notebook")
|
||||
async def create_notebook(body: NotebookCreate, db: AsyncSession = Depends(get_db)):
|
||||
cells = validate_notebook_cells(body.cells or [])
|
||||
if not cells:
|
||||
# Start with a default markdown cell
|
||||
cells = [{"id": "cell-0", "cell_type": "markdown", "source": "# Investigation Notes\n\nStart documenting your findings here.", "output": None, "metadata": {}}]
|
||||
|
||||
nb = Notebook(
|
||||
id=_new_id(),
|
||||
title=body.title,
|
||||
description=body.description,
|
||||
cells=cells,
|
||||
hunt_id=body.hunt_id,
|
||||
case_id=body.case_id,
|
||||
tags=body.tags,
|
||||
)
|
||||
db.add(nb)
|
||||
await db.commit()
|
||||
await db.refresh(nb)
|
||||
return _notebook_to_dict(nb)
|
||||
|
||||
|
||||
@router.put("/{notebook_id}", summary="Update notebook")
|
||||
async def update_notebook(
|
||||
notebook_id: str, body: NotebookUpdate, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
nb = await db.get(Notebook, notebook_id)
|
||||
if not nb:
|
||||
raise HTTPException(status_code=404, detail="Notebook not found")
|
||||
|
||||
if body.title is not None:
|
||||
nb.title = body.title
|
||||
if body.description is not None:
|
||||
nb.description = body.description
|
||||
if body.cells is not None:
|
||||
nb.cells = validate_notebook_cells(body.cells)
|
||||
if body.tags is not None:
|
||||
nb.tags = body.tags
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(nb)
|
||||
return _notebook_to_dict(nb)
|
||||
|
||||
|
||||
@router.post("/{notebook_id}/cells", summary="Add or update a cell")
|
||||
async def upsert_cell(
|
||||
notebook_id: str, body: CellUpdate, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
nb = await db.get(Notebook, notebook_id)
|
||||
if not nb:
|
||||
raise HTTPException(status_code=404, detail="Notebook not found")
|
||||
|
||||
cells = list(nb.cells or [])
|
||||
found = False
|
||||
for i, c in enumerate(cells):
|
||||
if c.get("id") == body.cell_id:
|
||||
if body.cell_type is not None:
|
||||
cells[i]["cell_type"] = body.cell_type
|
||||
if body.source is not None:
|
||||
cells[i]["source"] = body.source
|
||||
if body.output is not None:
|
||||
cells[i]["output"] = body.output
|
||||
if body.metadata is not None:
|
||||
cells[i]["metadata"] = body.metadata
|
||||
found = True
|
||||
break
|
||||
|
||||
if not found:
|
||||
cells.append({
|
||||
"id": body.cell_id,
|
||||
"cell_type": body.cell_type or "markdown",
|
||||
"source": body.source or "",
|
||||
"output": body.output,
|
||||
"metadata": body.metadata or {},
|
||||
})
|
||||
|
||||
nb.cells = cells
|
||||
await db.commit()
|
||||
await db.refresh(nb)
|
||||
return _notebook_to_dict(nb)
|
||||
|
||||
|
||||
@router.delete("/{notebook_id}/cells/{cell_id}", summary="Delete a cell")
|
||||
async def delete_cell(
|
||||
notebook_id: str, cell_id: str, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
nb = await db.get(Notebook, notebook_id)
|
||||
if not nb:
|
||||
raise HTTPException(status_code=404, detail="Notebook not found")
|
||||
|
||||
cells = [c for c in (nb.cells or []) if c.get("id") != cell_id]
|
||||
nb.cells = cells
|
||||
await db.commit()
|
||||
return {"ok": True, "remaining_cells": len(cells)}
|
||||
|
||||
|
||||
@router.delete("/{notebook_id}", summary="Delete notebook")
|
||||
async def delete_notebook(notebook_id: str, db: AsyncSession = Depends(get_db)):
|
||||
nb = await db.get(Notebook, notebook_id)
|
||||
if not nb:
|
||||
raise HTTPException(status_code=404, detail="Notebook not found")
|
||||
await db.delete(nb)
|
||||
await db.commit()
|
||||
return {"ok": True}
|
||||
|
||||
|
||||
# ── Playbooks ─────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
@router.get("/playbooks/templates", summary="List built-in playbook templates")
|
||||
async def list_playbook_templates():
|
||||
templates = get_builtin_playbooks()
|
||||
return {
|
||||
"templates": [
|
||||
{
|
||||
"name": t["name"],
|
||||
"description": t["description"],
|
||||
"category": t["category"],
|
||||
"tags": t["tags"],
|
||||
"step_count": len(t["steps"]),
|
||||
}
|
||||
for t in templates
|
||||
]
|
||||
}
|
||||
|
||||
|
||||
@router.get("/playbooks/templates/{name}", summary="Get playbook template detail")
|
||||
async def get_playbook_template_detail(name: str):
|
||||
template = get_playbook_template(name)
|
||||
if not template:
|
||||
raise HTTPException(status_code=404, detail="Playbook template not found")
|
||||
return template
|
||||
|
||||
|
||||
@router.post("/playbooks/start", summary="Start a playbook run")
|
||||
async def start_playbook(body: PlaybookStart, db: AsyncSession = Depends(get_db)):
|
||||
template = get_playbook_template(body.playbook_name)
|
||||
if not template:
|
||||
raise HTTPException(status_code=404, detail="Playbook template not found")
|
||||
|
||||
run = PlaybookRun(
|
||||
id=_new_id(),
|
||||
playbook_name=body.playbook_name,
|
||||
status="in-progress",
|
||||
current_step=1,
|
||||
total_steps=len(template["steps"]),
|
||||
step_results=[],
|
||||
hunt_id=body.hunt_id,
|
||||
case_id=body.case_id,
|
||||
started_by=body.started_by,
|
||||
)
|
||||
db.add(run)
|
||||
await db.commit()
|
||||
await db.refresh(run)
|
||||
return _run_to_dict(run)
|
||||
|
||||
|
||||
@router.get("/playbooks/runs", summary="List playbook runs")
|
||||
async def list_playbook_runs(
|
||||
status: str | None = Query(None),
|
||||
hunt_id: str | None = Query(None),
|
||||
limit: int = Query(50, ge=1, le=200),
|
||||
db: AsyncSession = Depends(get_db),
|
||||
):
|
||||
stmt = select(PlaybookRun)
|
||||
if status:
|
||||
stmt = stmt.where(PlaybookRun.status == status)
|
||||
if hunt_id:
|
||||
stmt = stmt.where(PlaybookRun.hunt_id == hunt_id)
|
||||
|
||||
results = (await db.execute(
|
||||
stmt.order_by(desc(PlaybookRun.created_at)).limit(limit)
|
||||
)).scalars().all()
|
||||
|
||||
return {"runs": [_run_to_dict(r) for r in results]}
|
||||
|
||||
|
||||
@router.get("/playbooks/runs/{run_id}", summary="Get playbook run detail")
|
||||
async def get_playbook_run(run_id: str, db: AsyncSession = Depends(get_db)):
|
||||
run = await db.get(PlaybookRun, run_id)
|
||||
if not run:
|
||||
raise HTTPException(status_code=404, detail="Run not found")
|
||||
|
||||
# Also include the template steps
|
||||
template = get_playbook_template(run.playbook_name)
|
||||
result = _run_to_dict(run)
|
||||
result["steps"] = template["steps"] if template else []
|
||||
return result
|
||||
|
||||
|
||||
@router.post("/playbooks/runs/{run_id}/complete-step", summary="Complete current playbook step")
|
||||
async def complete_step(
|
||||
run_id: str, body: StepComplete, db: AsyncSession = Depends(get_db)
|
||||
):
|
||||
run = await db.get(PlaybookRun, run_id)
|
||||
if not run:
|
||||
raise HTTPException(status_code=404, detail="Run not found")
|
||||
if run.status != "in-progress":
|
||||
raise HTTPException(status_code=400, detail="Run is not in progress")
|
||||
|
||||
step_results = list(run.step_results or [])
|
||||
step_results.append({
|
||||
"step": run.current_step,
|
||||
"status": body.status,
|
||||
"notes": body.notes,
|
||||
"completed_at": _utcnow().isoformat(),
|
||||
})
|
||||
run.step_results = step_results
|
||||
|
||||
if run.current_step >= run.total_steps:
|
||||
run.status = "completed"
|
||||
run.completed_at = _utcnow()
|
||||
else:
|
||||
run.current_step += 1
|
||||
|
||||
await db.commit()
|
||||
await db.refresh(run)
|
||||
return _run_to_dict(run)
|
||||
|
||||
|
||||
@router.post("/playbooks/runs/{run_id}/abort", summary="Abort a playbook run")
|
||||
async def abort_run(run_id: str, db: AsyncSession = Depends(get_db)):
|
||||
run = await db.get(PlaybookRun, run_id)
|
||||
if not run:
|
||||
raise HTTPException(status_code=404, detail="Run not found")
|
||||
run.status = "aborted"
|
||||
run.completed_at = _utcnow()
|
||||
await db.commit()
|
||||
return _run_to_dict(run)
|
||||
@@ -15,7 +15,7 @@ class AppConfig(BaseSettings):
|
||||
|
||||
# -- General --------------------------------------------------------
|
||||
APP_NAME: str = "ThreatHunt"
|
||||
APP_VERSION: str = "0.3.0"
|
||||
APP_VERSION: str = "0.4.0"
|
||||
DEBUG: bool = Field(default=False, description="Enable debug mode")
|
||||
|
||||
# -- Database -------------------------------------------------------
|
||||
|
||||
@@ -75,8 +75,20 @@ async def get_db() -> AsyncSession: # type: ignore[misc]
|
||||
|
||||
async def init_db() -> None:
|
||||
"""Create all tables (for dev / first-run). In production use Alembic."""
|
||||
from sqlalchemy import inspect as sa_inspect
|
||||
|
||||
async with engine.begin() as conn:
|
||||
await conn.run_sync(Base.metadata.create_all)
|
||||
# Only create tables that don't already exist (safe alongside Alembic)
|
||||
def _create_missing(sync_conn):
|
||||
inspector = sa_inspect(sync_conn)
|
||||
existing = set(inspector.get_table_names())
|
||||
tables_to_create = [
|
||||
t for t in Base.metadata.sorted_tables
|
||||
if t.name not in existing
|
||||
]
|
||||
Base.metadata.create_all(sync_conn, tables=tables_to_create)
|
||||
|
||||
await conn.run_sync(_create_missing)
|
||||
|
||||
|
||||
async def dispose_db() -> None:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
"""SQLAlchemy ORM models for ThreatHunt.
|
||||
|
||||
All persistent entities: datasets, hunts, conversations, annotations,
|
||||
hypotheses, enrichment results, users, and AI analysis tables.
|
||||
hypotheses, enrichment results, and users.
|
||||
"""
|
||||
|
||||
import uuid
|
||||
@@ -32,7 +32,8 @@ def _new_id() -> str:
|
||||
return uuid.uuid4().hex
|
||||
|
||||
|
||||
# -- Users ---
|
||||
# ── Users ──────────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class User(Base):
|
||||
__tablename__ = "users"
|
||||
@@ -41,16 +42,18 @@ class User(Base):
|
||||
username: Mapped[str] = mapped_column(String(64), unique=True, nullable=False, index=True)
|
||||
email: Mapped[str] = mapped_column(String(256), unique=True, nullable=False)
|
||||
hashed_password: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
role: Mapped[str] = mapped_column(String(16), default="analyst")
|
||||
role: Mapped[str] = mapped_column(String(16), default="analyst") # analyst | admin | viewer
|
||||
is_active: Mapped[bool] = mapped_column(Boolean, default=True)
|
||||
display_name: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
# relationships
|
||||
hunts: Mapped[list["Hunt"]] = relationship(back_populates="owner", lazy="selectin")
|
||||
annotations: Mapped[list["Annotation"]] = relationship(back_populates="author", lazy="selectin")
|
||||
|
||||
|
||||
# -- Hunts ---
|
||||
# ── Hunts ──────────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Hunt(Base):
|
||||
__tablename__ = "hunts"
|
||||
@@ -58,7 +61,7 @@ class Hunt(Base):
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
name: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
status: Mapped[str] = mapped_column(String(32), default="active")
|
||||
status: Mapped[str] = mapped_column(String(32), default="active") # active | closed | archived
|
||||
owner_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("users.id"), nullable=True
|
||||
)
|
||||
@@ -67,15 +70,15 @@ class Hunt(Base):
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
# relationships
|
||||
owner: Mapped[Optional["User"]] = relationship(back_populates="hunts", lazy="selectin")
|
||||
datasets: Mapped[list["Dataset"]] = relationship(back_populates="hunt", lazy="selectin")
|
||||
conversations: Mapped[list["Conversation"]] = relationship(back_populates="hunt", lazy="selectin")
|
||||
hypotheses: Mapped[list["Hypothesis"]] = relationship(back_populates="hunt", lazy="selectin")
|
||||
host_profiles: Mapped[list["HostProfile"]] = relationship(back_populates="hunt", lazy="noload")
|
||||
reports: Mapped[list["HuntReport"]] = relationship(back_populates="hunt", lazy="noload")
|
||||
|
||||
|
||||
# -- Datasets ---
|
||||
# ── Datasets ───────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Dataset(Base):
|
||||
__tablename__ = "datasets"
|
||||
@@ -83,44 +86,36 @@ class Dataset(Base):
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
name: Mapped[str] = mapped_column(String(256), nullable=False, index=True)
|
||||
filename: Mapped[str] = mapped_column(String(512), nullable=False)
|
||||
source_tool: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
|
||||
source_tool: Mapped[Optional[str]] = mapped_column(String(64), nullable=True) # velociraptor, etc.
|
||||
row_count: Mapped[int] = mapped_column(Integer, default=0)
|
||||
column_schema: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
normalized_columns: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
ioc_columns: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
ioc_columns: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True) # auto-detected IOC columns
|
||||
file_size_bytes: Mapped[int] = mapped_column(Integer, default=0)
|
||||
encoding: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
delimiter: Mapped[Optional[str]] = mapped_column(String(4), nullable=True)
|
||||
time_range_start: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
time_range_end: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
|
||||
# New Phase 1-2 columns
|
||||
processing_status: Mapped[str] = mapped_column(String(20), default="ready")
|
||||
artifact_type: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
error_message: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
file_path: Mapped[Optional[str]] = mapped_column(String(512), nullable=True)
|
||||
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
)
|
||||
uploaded_by: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
# relationships
|
||||
hunt: Mapped[Optional["Hunt"]] = relationship(back_populates="datasets", lazy="selectin")
|
||||
rows: Mapped[list["DatasetRow"]] = relationship(
|
||||
back_populates="dataset", lazy="noload", cascade="all, delete-orphan"
|
||||
)
|
||||
triage_results: Mapped[list["TriageResult"]] = relationship(
|
||||
back_populates="dataset", lazy="noload", cascade="all, delete-orphan"
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_datasets_hunt", "hunt_id"),
|
||||
Index("ix_datasets_status", "processing_status"),
|
||||
)
|
||||
|
||||
|
||||
class DatasetRow(Base):
|
||||
"""Individual row from a CSV dataset, stored as JSON blob."""
|
||||
__tablename__ = "dataset_rows"
|
||||
|
||||
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
|
||||
@@ -131,6 +126,7 @@ class DatasetRow(Base):
|
||||
data: Mapped[dict] = mapped_column(JSON, nullable=False)
|
||||
normalized_data: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
|
||||
# relationships
|
||||
dataset: Mapped["Dataset"] = relationship(back_populates="rows")
|
||||
annotations: Mapped[list["Annotation"]] = relationship(
|
||||
back_populates="row", lazy="noload"
|
||||
@@ -142,7 +138,8 @@ class DatasetRow(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- Conversations ---
|
||||
# ── Conversations ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Conversation(Base):
|
||||
__tablename__ = "conversations"
|
||||
@@ -160,6 +157,7 @@ class Conversation(Base):
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
# relationships
|
||||
hunt: Mapped[Optional["Hunt"]] = relationship(back_populates="conversations", lazy="selectin")
|
||||
messages: Mapped[list["Message"]] = relationship(
|
||||
back_populates="conversation", lazy="selectin", cascade="all, delete-orphan",
|
||||
@@ -174,15 +172,16 @@ class Message(Base):
|
||||
conversation_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("conversations.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
role: Mapped[str] = mapped_column(String(16), nullable=False)
|
||||
role: Mapped[str] = mapped_column(String(16), nullable=False) # user | agent | system
|
||||
content: Mapped[str] = mapped_column(Text, nullable=False)
|
||||
model_used: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
node_used: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
|
||||
node_used: Mapped[Optional[str]] = mapped_column(String(64), nullable=True) # wile | roadrunner | cluster
|
||||
token_count: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
||||
latency_ms: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
||||
response_meta: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
# relationships
|
||||
conversation: Mapped["Conversation"] = relationship(back_populates="messages")
|
||||
|
||||
__table_args__ = (
|
||||
@@ -190,7 +189,8 @@ class Message(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- Annotations ---
|
||||
# ── Annotations ───────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Annotation(Base):
|
||||
__tablename__ = "annotations"
|
||||
@@ -206,14 +206,19 @@ class Annotation(Base):
|
||||
String(32), ForeignKey("users.id"), nullable=True
|
||||
)
|
||||
text: Mapped[str] = mapped_column(Text, nullable=False)
|
||||
severity: Mapped[str] = mapped_column(String(16), default="info")
|
||||
tag: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
severity: Mapped[str] = mapped_column(
|
||||
String(16), default="info"
|
||||
) # info | low | medium | high | critical
|
||||
tag: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), nullable=True
|
||||
) # suspicious | benign | needs-review
|
||||
highlight_color: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
# relationships
|
||||
row: Mapped[Optional["DatasetRow"]] = relationship(back_populates="annotations")
|
||||
author: Mapped[Optional["User"]] = relationship(back_populates="annotations")
|
||||
|
||||
@@ -223,7 +228,8 @@ class Annotation(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- Hypotheses ---
|
||||
# ── Hypotheses ────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Hypothesis(Base):
|
||||
__tablename__ = "hypotheses"
|
||||
@@ -235,7 +241,9 @@ class Hypothesis(Base):
|
||||
title: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
mitre_technique: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
status: Mapped[str] = mapped_column(String(16), default="draft")
|
||||
status: Mapped[str] = mapped_column(
|
||||
String(16), default="draft"
|
||||
) # draft | active | confirmed | rejected
|
||||
evidence_row_ids: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
evidence_notes: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
@@ -243,6 +251,7 @@ class Hypothesis(Base):
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
# relationships
|
||||
hunt: Mapped[Optional["Hunt"]] = relationship(back_populates="hypotheses", lazy="selectin")
|
||||
|
||||
__table_args__ = (
|
||||
@@ -250,16 +259,21 @@ class Hypothesis(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- Enrichment Results ---
|
||||
# ── Enrichment Results ────────────────────────────────────────────────
|
||||
|
||||
|
||||
class EnrichmentResult(Base):
|
||||
__tablename__ = "enrichment_results"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
ioc_value: Mapped[str] = mapped_column(String(512), nullable=False, index=True)
|
||||
ioc_type: Mapped[str] = mapped_column(String(32), nullable=False)
|
||||
source: Mapped[str] = mapped_column(String(32), nullable=False)
|
||||
verdict: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
|
||||
ioc_type: Mapped[str] = mapped_column(
|
||||
String(32), nullable=False
|
||||
) # ip | hash_md5 | hash_sha1 | hash_sha256 | domain | url
|
||||
source: Mapped[str] = mapped_column(String(32), nullable=False) # virustotal | abuseipdb | shodan | ai
|
||||
verdict: Mapped[Optional[str]] = mapped_column(
|
||||
String(16), nullable=True
|
||||
) # clean | suspicious | malicious | unknown
|
||||
confidence: Mapped[Optional[float]] = mapped_column(Float, nullable=True)
|
||||
raw_result: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
summary: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
@@ -274,24 +288,28 @@ class EnrichmentResult(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- AUP Keyword Themes & Keywords ---
|
||||
# ── AUP Keyword Themes & Keywords ────────────────────────────────────
|
||||
|
||||
|
||||
class KeywordTheme(Base):
|
||||
"""A named category of keywords for AUP scanning (e.g. gambling, gaming)."""
|
||||
__tablename__ = "keyword_themes"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
name: Mapped[str] = mapped_column(String(128), unique=True, nullable=False, index=True)
|
||||
color: Mapped[str] = mapped_column(String(16), default="#9e9e9e")
|
||||
color: Mapped[str] = mapped_column(String(16), default="#9e9e9e") # hex chip color
|
||||
enabled: Mapped[bool] = mapped_column(Boolean, default=True)
|
||||
is_builtin: Mapped[bool] = mapped_column(Boolean, default=False)
|
||||
is_builtin: Mapped[bool] = mapped_column(Boolean, default=False) # seed-provided
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
# relationships
|
||||
keywords: Mapped[list["Keyword"]] = relationship(
|
||||
back_populates="theme", lazy="selectin", cascade="all, delete-orphan"
|
||||
)
|
||||
|
||||
|
||||
class Keyword(Base):
|
||||
"""Individual keyword / pattern belonging to a theme."""
|
||||
__tablename__ = "keywords"
|
||||
|
||||
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
|
||||
@@ -302,6 +320,7 @@ class Keyword(Base):
|
||||
is_regex: Mapped[bool] = mapped_column(Boolean, default=False)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
# relationships
|
||||
theme: Mapped["KeywordTheme"] = relationship(back_populates="keywords")
|
||||
|
||||
__table_args__ = (
|
||||
@@ -310,91 +329,223 @@ class Keyword(Base):
|
||||
)
|
||||
|
||||
|
||||
# -- AI Analysis Tables (Phase 2) ---
|
||||
# ── Cases ─────────────────────────────────────────────────────────────
|
||||
|
||||
class TriageResult(Base):
|
||||
__tablename__ = "triage_results"
|
||||
|
||||
class Case(Base):
|
||||
"""Incident / investigation case, inspired by TheHive."""
|
||||
__tablename__ = "cases"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
dataset_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("datasets.id", ondelete="CASCADE"), nullable=False, index=True
|
||||
title: Mapped[str] = mapped_column(String(512), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
severity: Mapped[str] = mapped_column(String(16), default="medium") # info|low|medium|high|critical
|
||||
tlp: Mapped[str] = mapped_column(String(16), default="amber") # white|green|amber|red
|
||||
pap: Mapped[str] = mapped_column(String(16), default="amber") # white|green|amber|red
|
||||
status: Mapped[str] = mapped_column(String(24), default="open") # open|in-progress|resolved|closed
|
||||
priority: Mapped[int] = mapped_column(Integer, default=2) # 1(urgent)..4(low)
|
||||
assignee: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
tags: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
)
|
||||
row_start: Mapped[int] = mapped_column(Integer, nullable=False)
|
||||
row_end: Mapped[int] = mapped_column(Integer, nullable=False)
|
||||
risk_score: Mapped[float] = mapped_column(Float, default=0.0)
|
||||
verdict: Mapped[str] = mapped_column(String(20), default="pending")
|
||||
findings: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
suspicious_indicators: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
mitre_techniques: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
model_used: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
node_used: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
dataset: Mapped["Dataset"] = relationship(back_populates="triage_results")
|
||||
|
||||
|
||||
class HostProfile(Base):
|
||||
__tablename__ = "host_profiles"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
hunt_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id", ondelete="CASCADE"), nullable=False, index=True
|
||||
owner_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("users.id"), nullable=True
|
||||
)
|
||||
hostname: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
fqdn: Mapped[Optional[str]] = mapped_column(String(512), nullable=True)
|
||||
client_id: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
|
||||
risk_score: Mapped[float] = mapped_column(Float, default=0.0)
|
||||
risk_level: Mapped[str] = mapped_column(String(20), default="unknown")
|
||||
artifact_summary: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
timeline_summary: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
suspicious_findings: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
mitre_techniques: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
llm_analysis: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
model_used: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
node_used: Mapped[Optional[str]] = mapped_column(String(64), nullable=True)
|
||||
iocs: Mapped[Optional[list]] = mapped_column(JSON, nullable=True) # [{type, value, description}]
|
||||
started_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
resolved_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
hunt: Mapped["Hunt"] = relationship(back_populates="host_profiles")
|
||||
# relationships
|
||||
tasks: Mapped[list["CaseTask"]] = relationship(
|
||||
back_populates="case", lazy="selectin", cascade="all, delete-orphan"
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_cases_hunt", "hunt_id"),
|
||||
Index("ix_cases_status", "status"),
|
||||
)
|
||||
|
||||
|
||||
class HuntReport(Base):
|
||||
__tablename__ = "hunt_reports"
|
||||
class CaseTask(Base):
|
||||
"""Task within a case (Kanban board item)."""
|
||||
__tablename__ = "case_tasks"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
hunt_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id", ondelete="CASCADE"), nullable=False, index=True
|
||||
case_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("cases.id", ondelete="CASCADE"), nullable=False
|
||||
)
|
||||
status: Mapped[str] = mapped_column(String(20), default="pending")
|
||||
exec_summary: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
full_report: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
findings: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
recommendations: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
mitre_mapping: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
ioc_table: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
host_risk_summary: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
models_used: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
generation_time_ms: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
||||
title: Mapped[str] = mapped_column(String(512), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
status: Mapped[str] = mapped_column(String(24), default="todo") # todo|in-progress|done
|
||||
assignee: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
order: Mapped[int] = mapped_column(Integer, default=0)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
hunt: Mapped["Hunt"] = relationship(back_populates="reports")
|
||||
# relationships
|
||||
case: Mapped["Case"] = relationship(back_populates="tasks")
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_case_tasks_case", "case_id"),
|
||||
)
|
||||
|
||||
|
||||
class AnomalyResult(Base):
|
||||
__tablename__ = "anomaly_results"
|
||||
# ── Activity Log ──────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class ActivityLog(Base):
|
||||
"""Audit trail / activity log for cases and hunts."""
|
||||
__tablename__ = "activity_logs"
|
||||
|
||||
id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
|
||||
entity_type: Mapped[str] = mapped_column(String(32), nullable=False) # case|hunt|annotation
|
||||
entity_id: Mapped[str] = mapped_column(String(32), nullable=False)
|
||||
action: Mapped[str] = mapped_column(String(64), nullable=False) # created|updated|status_changed|etc
|
||||
details: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True)
|
||||
user_id: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_activity_entity", "entity_type", "entity_id"),
|
||||
)
|
||||
|
||||
|
||||
# ── Alerts ────────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Alert(Base):
|
||||
"""Security alert generated by analyzers or rules."""
|
||||
__tablename__ = "alerts"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
dataset_id: Mapped[str] = mapped_column(
|
||||
String(32), ForeignKey("datasets.id", ondelete="CASCADE"), nullable=False, index=True
|
||||
title: Mapped[str] = mapped_column(String(512), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
severity: Mapped[str] = mapped_column(String(16), default="medium") # critical|high|medium|low|info
|
||||
status: Mapped[str] = mapped_column(String(24), default="new") # new|acknowledged|in-progress|resolved|false-positive
|
||||
analyzer: Mapped[str] = mapped_column(String(64), nullable=False) # which analyzer produced it
|
||||
score: Mapped[float] = mapped_column(Float, default=0.0)
|
||||
evidence: Mapped[Optional[list]] = mapped_column(JSON, nullable=True) # [{row_index, field, value, ...}]
|
||||
mitre_technique: Mapped[Optional[str]] = mapped_column(String(32), nullable=True)
|
||||
tags: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
)
|
||||
row_id: Mapped[Optional[int]] = mapped_column(
|
||||
Integer, ForeignKey("dataset_rows.id", ondelete="CASCADE"), nullable=True
|
||||
dataset_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("datasets.id"), nullable=True
|
||||
)
|
||||
case_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("cases.id"), nullable=True
|
||||
)
|
||||
assignee: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
acknowledged_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
resolved_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_alerts_severity", "severity"),
|
||||
Index("ix_alerts_status", "status"),
|
||||
Index("ix_alerts_hunt", "hunt_id"),
|
||||
Index("ix_alerts_dataset", "dataset_id"),
|
||||
)
|
||||
|
||||
|
||||
class AlertRule(Base):
|
||||
"""User-defined alert rule (triggers analyzers automatically on upload)."""
|
||||
__tablename__ = "alert_rules"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
name: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
analyzer: Mapped[str] = mapped_column(String(64), nullable=False) # analyzer name
|
||||
config: Mapped[Optional[dict]] = mapped_column(JSON, nullable=True) # analyzer config overrides
|
||||
severity_override: Mapped[Optional[str]] = mapped_column(String(16), nullable=True)
|
||||
enabled: Mapped[bool] = mapped_column(Boolean, default=True)
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
) # None = global
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_alert_rules_analyzer", "analyzer"),
|
||||
)
|
||||
|
||||
|
||||
# ── Notebooks ────────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class Notebook(Base):
|
||||
"""Investigation notebook — cell-based document for analyst notes and queries."""
|
||||
__tablename__ = "notebooks"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
title: Mapped[str] = mapped_column(String(512), nullable=False)
|
||||
description: Mapped[Optional[str]] = mapped_column(Text, nullable=True)
|
||||
cells: Mapped[Optional[list]] = mapped_column(JSON, nullable=True) # [{id, cell_type, source, output, metadata}]
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
)
|
||||
case_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("cases.id"), nullable=True
|
||||
)
|
||||
owner_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("users.id"), nullable=True
|
||||
)
|
||||
tags: Mapped[Optional[list]] = mapped_column(JSON, nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_notebooks_hunt", "hunt_id"),
|
||||
)
|
||||
|
||||
|
||||
# ── Playbook Runs ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class PlaybookRun(Base):
|
||||
"""Record of a playbook execution (links a template to a hunt/case)."""
|
||||
__tablename__ = "playbook_runs"
|
||||
|
||||
id: Mapped[str] = mapped_column(String(32), primary_key=True, default=_new_id)
|
||||
playbook_name: Mapped[str] = mapped_column(String(256), nullable=False)
|
||||
status: Mapped[str] = mapped_column(String(24), default="in-progress") # in-progress | completed | aborted
|
||||
current_step: Mapped[int] = mapped_column(Integer, default=1)
|
||||
total_steps: Mapped[int] = mapped_column(Integer, default=0)
|
||||
step_results: Mapped[Optional[list]] = mapped_column(JSON, nullable=True) # [{step, status, notes, completed_at}]
|
||||
hunt_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("hunts.id"), nullable=True
|
||||
)
|
||||
case_id: Mapped[Optional[str]] = mapped_column(
|
||||
String(32), ForeignKey("cases.id"), nullable=True
|
||||
)
|
||||
started_by: Mapped[Optional[str]] = mapped_column(String(128), nullable=True)
|
||||
created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), default=_utcnow)
|
||||
updated_at: Mapped[datetime] = mapped_column(
|
||||
DateTime(timezone=True), default=_utcnow, onupdate=_utcnow
|
||||
)
|
||||
completed_at: Mapped[Optional[datetime]] = mapped_column(DateTime(timezone=True), nullable=True)
|
||||
|
||||
__table_args__ = (
|
||||
Index("ix_playbook_runs_hunt", "hunt_id"),
|
||||
Index("ix_playbook_runs_status", "status"),
|
||||
)
|
||||
<<<<<<< HEAD
|
||||
anomaly_score: Mapped[float] = mapped_column(Float, default=0.0)
|
||||
distance_from_centroid: Mapped[Optional[float]] = mapped_column(Float, nullable=True)
|
||||
cluster_id: Mapped[Optional[int]] = mapped_column(Integer, nullable=True)
|
||||
@@ -505,3 +656,5 @@ class SavedSearch(Base):
|
||||
__table_args__ = (
|
||||
Index("ix_saved_searches_type", "search_type"),
|
||||
)
|
||||
=======
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
@@ -1,12 +1,10 @@
|
||||
"""ThreatHunt backend application.
|
||||
|
||||
Wires together: database, CORS, agent routes, dataset routes, hunt routes,
|
||||
annotation/hypothesis routes, analysis routes, network routes, job queue,
|
||||
load balancer. DB tables are auto-created on startup.
|
||||
annotation/hypothesis routes. DB tables are auto-created on startup.
|
||||
"""
|
||||
|
||||
import logging
|
||||
import os
|
||||
from contextlib import asynccontextmanager
|
||||
|
||||
from fastapi import FastAPI
|
||||
@@ -23,13 +21,19 @@ from app.api.routes.correlation import router as correlation_router
|
||||
from app.api.routes.reports import router as reports_router
|
||||
from app.api.routes.auth import router as auth_router
|
||||
from app.api.routes.keywords import router as keywords_router
|
||||
from app.api.routes.analysis import router as analysis_router
|
||||
from app.api.routes.network import router as network_router
|
||||
<<<<<<< HEAD
|
||||
from app.api.routes.mitre import router as mitre_router
|
||||
from app.api.routes.timeline import router as timeline_router
|
||||
from app.api.routes.playbooks import router as playbooks_router
|
||||
from app.api.routes.saved_searches import router as searches_router
|
||||
from app.api.routes.stix_export import router as stix_router
|
||||
=======
|
||||
from app.api.routes.analysis import router as analysis_router
|
||||
from app.api.routes.cases import router as cases_router
|
||||
from app.api.routes.alerts import router as alerts_router
|
||||
from app.api.routes.notebooks import router as notebooks_router
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
@@ -37,20 +41,16 @@ logger = logging.getLogger(__name__)
|
||||
@asynccontextmanager
|
||||
async def lifespan(app: FastAPI):
|
||||
"""Startup / shutdown lifecycle."""
|
||||
logger.info("Starting ThreatHunt API ...")
|
||||
logger.info("Starting ThreatHunt API …")
|
||||
await init_db()
|
||||
logger.info("Database initialised")
|
||||
|
||||
# Ensure uploads directory exists
|
||||
os.makedirs(settings.UPLOAD_DIR, exist_ok=True)
|
||||
logger.info("Upload dir: %s", os.path.abspath(settings.UPLOAD_DIR))
|
||||
|
||||
# Seed default AUP keyword themes
|
||||
from app.db import async_session_factory
|
||||
from app.services.keyword_defaults import seed_defaults
|
||||
async with async_session_factory() as seed_db:
|
||||
await seed_defaults(seed_db)
|
||||
logger.info("AUP keyword defaults checked")
|
||||
<<<<<<< HEAD
|
||||
|
||||
# Start job queue
|
||||
from app.services.job_queue import (
|
||||
@@ -141,6 +141,10 @@ async def lifespan(app: FastAPI):
|
||||
await _lb.stop_health_loop()
|
||||
logger.info("Load balancer stopped")
|
||||
|
||||
=======
|
||||
yield
|
||||
logger.info("Shutting down …")
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
from app.agents.providers_v2 import cleanup_client
|
||||
from app.services.enrichment import enrichment_engine
|
||||
await cleanup_client()
|
||||
@@ -148,13 +152,15 @@ async def lifespan(app: FastAPI):
|
||||
await dispose_db()
|
||||
|
||||
|
||||
# Create FastAPI application
|
||||
app = FastAPI(
|
||||
title="ThreatHunt API",
|
||||
description="Analyst-assist threat hunting platform powered by Wile & Roadrunner LLM cluster",
|
||||
version=settings.APP_VERSION,
|
||||
version="0.3.0",
|
||||
lifespan=lifespan,
|
||||
)
|
||||
|
||||
# Configure CORS
|
||||
app.add_middleware(
|
||||
CORSMiddleware,
|
||||
allow_origins=settings.cors_origins,
|
||||
@@ -174,17 +180,24 @@ app.include_router(enrichment_router)
|
||||
app.include_router(correlation_router)
|
||||
app.include_router(reports_router)
|
||||
app.include_router(keywords_router)
|
||||
app.include_router(analysis_router)
|
||||
app.include_router(network_router)
|
||||
<<<<<<< HEAD
|
||||
app.include_router(mitre_router)
|
||||
app.include_router(timeline_router)
|
||||
app.include_router(playbooks_router)
|
||||
app.include_router(searches_router)
|
||||
app.include_router(stix_router)
|
||||
=======
|
||||
app.include_router(analysis_router)
|
||||
app.include_router(cases_router)
|
||||
app.include_router(alerts_router)
|
||||
app.include_router(notebooks_router)
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
|
||||
@app.get("/", tags=["health"])
|
||||
async def root():
|
||||
"""API health check."""
|
||||
return {
|
||||
"service": "ThreatHunt API",
|
||||
"version": settings.APP_VERSION,
|
||||
@@ -196,6 +209,7 @@ async def root():
|
||||
"openwebui": settings.OPENWEBUI_URL,
|
||||
},
|
||||
}
|
||||
<<<<<<< HEAD
|
||||
|
||||
|
||||
@app.get("/health", tags=["health"])
|
||||
@@ -205,3 +219,5 @@ async def health():
|
||||
"version": settings.APP_VERSION,
|
||||
"status": "ok",
|
||||
}
|
||||
=======
|
||||
>>>>>>> 7c454036c7ef6a3d6517f98cbee643fd0238e0b2
|
||||
|
||||
464
backend/app/services/analyzers.py
Normal file
464
backend/app/services/analyzers.py
Normal file
@@ -0,0 +1,464 @@
|
||||
"""Pluggable Analyzer Framework for ThreatHunt.
|
||||
|
||||
Each analyzer implements a simple protocol:
|
||||
- name / description properties
|
||||
- async analyze(rows, config) -> list[AlertCandidate]
|
||||
|
||||
The AnalyzerRegistry discovers and runs all enabled analyzers against
|
||||
a dataset, producing alert candidates that the alert system can persist.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import math
|
||||
import re
|
||||
from abc import ABC, abstractmethod
|
||||
from collections import Counter, defaultdict
|
||||
from dataclasses import dataclass, field
|
||||
from typing import Any, Optional, Sequence
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ── Alert Candidate DTO ──────────────────────────────────────────────
|
||||
|
||||
|
||||
@dataclass
|
||||
class AlertCandidate:
|
||||
"""A single finding from an analyzer, before it becomes a persisted Alert."""
|
||||
analyzer: str
|
||||
title: str
|
||||
severity: str # critical | high | medium | low | info
|
||||
description: str
|
||||
evidence: list[dict] = field(default_factory=list) # [{row_index, field, value, ...}]
|
||||
mitre_technique: Optional[str] = None
|
||||
tags: list[str] = field(default_factory=list)
|
||||
score: float = 0.0 # 0-100
|
||||
|
||||
|
||||
# ── Base Analyzer ────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class BaseAnalyzer(ABC):
|
||||
"""Interface every analyzer must implement."""
|
||||
|
||||
@property
|
||||
@abstractmethod
|
||||
def name(self) -> str: ...
|
||||
|
||||
@property
|
||||
@abstractmethod
|
||||
def description(self) -> str: ...
|
||||
|
||||
@abstractmethod
|
||||
async def analyze(
|
||||
self, rows: list[dict[str, Any]], config: dict[str, Any] | None = None
|
||||
) -> list[AlertCandidate]: ...
|
||||
|
||||
|
||||
# ── Built-in Analyzers ──────────────────────────────────────────────
|
||||
|
||||
|
||||
class EntropyAnalyzer(BaseAnalyzer):
|
||||
"""Detects high-entropy strings (encoded payloads, obfuscated commands)."""
|
||||
|
||||
name = "entropy"
|
||||
description = "Flags fields with high Shannon entropy (possible encoding/obfuscation)"
|
||||
|
||||
ENTROPY_FIELDS = [
|
||||
"command_line", "commandline", "process_command_line", "cmdline",
|
||||
"powershell_command", "script_block", "url", "uri", "path",
|
||||
"file_path", "target_filename", "query", "dns_query",
|
||||
]
|
||||
DEFAULT_THRESHOLD = 4.5
|
||||
|
||||
@staticmethod
|
||||
def _shannon(s: str) -> float:
|
||||
if not s or len(s) < 8:
|
||||
return 0.0
|
||||
freq = Counter(s)
|
||||
length = len(s)
|
||||
return -sum((c / length) * math.log2(c / length) for c in freq.values())
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
config = config or {}
|
||||
threshold = config.get("entropy_threshold", self.DEFAULT_THRESHOLD)
|
||||
min_length = config.get("min_length", 20)
|
||||
alerts: list[AlertCandidate] = []
|
||||
|
||||
for idx, row in enumerate(rows):
|
||||
for field_name in self.ENTROPY_FIELDS:
|
||||
val = str(row.get(field_name, ""))
|
||||
if len(val) < min_length:
|
||||
continue
|
||||
ent = self._shannon(val)
|
||||
if ent >= threshold:
|
||||
sev = "critical" if ent > 5.5 else "high" if ent > 5.0 else "medium"
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"High-entropy string in {field_name}",
|
||||
severity=sev,
|
||||
description=f"Shannon entropy {ent:.2f} (threshold {threshold}) in row {idx}, field '{field_name}'",
|
||||
evidence=[{"row_index": idx, "field": field_name, "value": val[:200], "entropy": round(ent, 3)}],
|
||||
mitre_technique="T1027", # Obfuscated Files or Information
|
||||
tags=["obfuscation", "entropy"],
|
||||
score=min(100, ent * 18),
|
||||
))
|
||||
return alerts
|
||||
|
||||
|
||||
class SuspiciousCommandAnalyzer(BaseAnalyzer):
|
||||
"""Detects known-bad command patterns (credential dumping, lateral movement, persistence)."""
|
||||
|
||||
name = "suspicious_commands"
|
||||
description = "Flags processes executing known-suspicious command patterns"
|
||||
|
||||
PATTERNS: list[tuple[str, str, str, str]] = [
|
||||
# (regex, title, severity, mitre_technique)
|
||||
(r"mimikatz|sekurlsa|lsadump|kerberos::list", "Mimikatz / Credential Dumping", "critical", "T1003"),
|
||||
(r"(?i)-enc\s+[A-Za-z0-9+/=]{40,}", "Encoded PowerShell command", "high", "T1059.001"),
|
||||
(r"(?i)invoke-(mimikatz|expression|webrequest|shellcode)", "Suspicious PowerShell Invoke", "high", "T1059.001"),
|
||||
(r"(?i)net\s+(user|localgroup|group)\s+/add", "Local account creation", "high", "T1136.001"),
|
||||
(r"(?i)schtasks\s+/create", "Scheduled task creation", "medium", "T1053.005"),
|
||||
(r"(?i)reg\s+add\s+.*\\run", "Registry Run key persistence", "high", "T1547.001"),
|
||||
(r"(?i)wmic\s+.*(process\s+call|shadowcopy\s+delete)", "WMI abuse / shadow copy deletion", "critical", "T1047"),
|
||||
(r"(?i)psexec|winrm|wmic\s+/node:", "Lateral movement tool", "high", "T1021"),
|
||||
(r"(?i)certutil\s+-urlcache", "Certutil download (LOLBin)", "high", "T1105"),
|
||||
(r"(?i)bitsadmin\s+/transfer", "BITSAdmin download", "medium", "T1197"),
|
||||
(r"(?i)vssadmin\s+delete\s+shadows", "VSS shadow deletion (ransomware)", "critical", "T1490"),
|
||||
(r"(?i)bcdedit.*recoveryenabled.*no", "Boot config tamper (ransomware)", "critical", "T1490"),
|
||||
(r"(?i)attrib\s+\+h\s+\+s", "Hidden file attribute set", "low", "T1564.001"),
|
||||
(r"(?i)netsh\s+advfirewall\s+.*disable", "Firewall disabled", "high", "T1562.004"),
|
||||
(r"(?i)whoami\s*/priv", "Privilege enumeration", "medium", "T1033"),
|
||||
(r"(?i)nltest\s+/dclist", "Domain controller enumeration", "medium", "T1018"),
|
||||
(r"(?i)dsquery|ldapsearch|adfind", "Active Directory enumeration", "medium", "T1087.002"),
|
||||
(r"(?i)procdump.*-ma\s+lsass", "LSASS memory dump", "critical", "T1003.001"),
|
||||
(r"(?i)rundll32.*comsvcs.*MiniDump", "LSASS dump via comsvcs", "critical", "T1003.001"),
|
||||
]
|
||||
|
||||
CMD_FIELDS = [
|
||||
"command_line", "commandline", "process_command_line", "cmdline",
|
||||
"parent_command_line", "powershell_command",
|
||||
]
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
alerts: list[AlertCandidate] = []
|
||||
compiled = [(re.compile(p, re.IGNORECASE), t, s, m) for p, t, s, m in self.PATTERNS]
|
||||
|
||||
for idx, row in enumerate(rows):
|
||||
for fld in self.CMD_FIELDS:
|
||||
val = str(row.get(fld, ""))
|
||||
if len(val) < 3:
|
||||
continue
|
||||
for pattern, title, sev, mitre in compiled:
|
||||
if pattern.search(val):
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=title,
|
||||
severity=sev,
|
||||
description=f"Suspicious command pattern in row {idx}: {val[:200]}",
|
||||
evidence=[{"row_index": idx, "field": fld, "value": val[:300]}],
|
||||
mitre_technique=mitre,
|
||||
tags=["command", "suspicious"],
|
||||
score={"critical": 95, "high": 80, "medium": 60, "low": 30}.get(sev, 50),
|
||||
))
|
||||
return alerts
|
||||
|
||||
|
||||
class NetworkAnomalyAnalyzer(BaseAnalyzer):
|
||||
"""Detects anomalous network patterns (beaconing, unusual ports, large transfers)."""
|
||||
|
||||
name = "network_anomaly"
|
||||
description = "Flags anomalous network behavior (beaconing, unusual ports, large transfers)"
|
||||
|
||||
SUSPICIOUS_PORTS = {4444, 5555, 6666, 8888, 9999, 1234, 31337, 12345, 54321, 1337}
|
||||
C2_PORTS = {443, 8443, 8080, 4443, 9443}
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
config = config or {}
|
||||
alerts: list[AlertCandidate] = []
|
||||
|
||||
# Track destination IP frequency for beaconing detection
|
||||
dst_freq: dict[str, list[int]] = defaultdict(list)
|
||||
port_hits: list[tuple[int, str, int]] = []
|
||||
|
||||
for idx, row in enumerate(rows):
|
||||
dst_ip = str(row.get("dst_ip", row.get("destination_ip", row.get("dest_ip", ""))))
|
||||
dst_port = row.get("dst_port", row.get("destination_port", row.get("dest_port", "")))
|
||||
|
||||
if dst_ip and dst_ip != "":
|
||||
dst_freq[dst_ip].append(idx)
|
||||
|
||||
if dst_port:
|
||||
try:
|
||||
port_num = int(dst_port)
|
||||
if port_num in self.SUSPICIOUS_PORTS:
|
||||
port_hits.append((idx, dst_ip, port_num))
|
||||
except (ValueError, TypeError):
|
||||
pass
|
||||
|
||||
# Large transfer detection
|
||||
bytes_val = row.get("bytes_sent", row.get("bytes_out", row.get("sent_bytes", 0)))
|
||||
try:
|
||||
if int(bytes_val or 0) > config.get("large_transfer_threshold", 10_000_000):
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title="Large data transfer detected",
|
||||
severity="medium",
|
||||
description=f"Row {idx}: {bytes_val} bytes sent to {dst_ip}",
|
||||
evidence=[{"row_index": idx, "dst_ip": dst_ip, "bytes": str(bytes_val)}],
|
||||
mitre_technique="T1048",
|
||||
tags=["exfiltration", "network"],
|
||||
score=65,
|
||||
))
|
||||
except (ValueError, TypeError):
|
||||
pass
|
||||
|
||||
# Beaconing: IPs contacted more than threshold times
|
||||
beacon_thresh = config.get("beacon_threshold", 20)
|
||||
for ip, indices in dst_freq.items():
|
||||
if len(indices) >= beacon_thresh:
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"Possible beaconing to {ip}",
|
||||
severity="high",
|
||||
description=f"Destination {ip} contacted {len(indices)} times (threshold: {beacon_thresh})",
|
||||
evidence=[{"dst_ip": ip, "contact_count": len(indices), "sample_rows": indices[:10]}],
|
||||
mitre_technique="T1071",
|
||||
tags=["beaconing", "c2", "network"],
|
||||
score=min(95, 50 + len(indices)),
|
||||
))
|
||||
|
||||
# Suspicious ports
|
||||
for idx, ip, port in port_hits:
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"Connection on suspicious port {port}",
|
||||
severity="medium",
|
||||
description=f"Row {idx}: connection to {ip}:{port}",
|
||||
evidence=[{"row_index": idx, "dst_ip": ip, "dst_port": port}],
|
||||
mitre_technique="T1571",
|
||||
tags=["suspicious_port", "network"],
|
||||
score=55,
|
||||
))
|
||||
|
||||
return alerts
|
||||
|
||||
|
||||
class FrequencyAnomalyAnalyzer(BaseAnalyzer):
|
||||
"""Detects statistically rare values that may indicate anomalies."""
|
||||
|
||||
name = "frequency_anomaly"
|
||||
description = "Flags statistically rare field values (potential anomalies)"
|
||||
|
||||
FIELDS_TO_CHECK = [
|
||||
"process_name", "image_name", "parent_process_name",
|
||||
"user", "username", "user_name",
|
||||
"event_type", "action", "status",
|
||||
]
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
config = config or {}
|
||||
rarity_threshold = config.get("rarity_threshold", 0.01) # <1% occurrence
|
||||
min_rows = config.get("min_rows", 50)
|
||||
alerts: list[AlertCandidate] = []
|
||||
|
||||
if len(rows) < min_rows:
|
||||
return alerts
|
||||
|
||||
for fld in self.FIELDS_TO_CHECK:
|
||||
values = [str(row.get(fld, "")) for row in rows if row.get(fld)]
|
||||
if not values:
|
||||
continue
|
||||
counts = Counter(values)
|
||||
total = len(values)
|
||||
|
||||
for val, cnt in counts.items():
|
||||
pct = cnt / total
|
||||
if pct <= rarity_threshold and cnt <= 3:
|
||||
# Find row indices
|
||||
indices = [i for i, r in enumerate(rows) if str(r.get(fld, "")) == val]
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"Rare {fld}: {val[:80]}",
|
||||
severity="low",
|
||||
description=f"'{val}' appears {cnt}/{total} times ({pct:.2%}) in field '{fld}'",
|
||||
evidence=[{"field": fld, "value": val[:200], "count": cnt, "total": total, "rows": indices[:5]}],
|
||||
tags=["anomaly", "rare"],
|
||||
score=max(20, 50 - (pct * 5000)),
|
||||
))
|
||||
|
||||
return alerts
|
||||
|
||||
|
||||
class AuthAnomalyAnalyzer(BaseAnalyzer):
|
||||
"""Detects authentication anomalies (brute force, unusual logon types)."""
|
||||
|
||||
name = "auth_anomaly"
|
||||
description = "Flags authentication anomalies (failed logins, unusual logon types)"
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
config = config or {}
|
||||
alerts: list[AlertCandidate] = []
|
||||
|
||||
# Track failed logins per user
|
||||
failed_by_user: dict[str, list[int]] = defaultdict(list)
|
||||
logon_types: dict[str, list[int]] = defaultdict(list)
|
||||
|
||||
for idx, row in enumerate(rows):
|
||||
event_type = str(row.get("event_type", row.get("action", ""))).lower()
|
||||
status = str(row.get("status", row.get("result", ""))).lower()
|
||||
user = str(row.get("username", row.get("user", row.get("user_name", ""))))
|
||||
logon_type = str(row.get("logon_type", ""))
|
||||
|
||||
if "logon" in event_type or "auth" in event_type or "login" in event_type:
|
||||
if "fail" in status or "4625" in str(row.get("event_id", "")):
|
||||
if user:
|
||||
failed_by_user[user].append(idx)
|
||||
|
||||
if logon_type in ("3", "10"): # Network/RemoteInteractive
|
||||
logon_types[logon_type].append(idx)
|
||||
|
||||
# Brute force: >5 failed logins for same user
|
||||
brute_thresh = config.get("brute_force_threshold", 5)
|
||||
for user, indices in failed_by_user.items():
|
||||
if len(indices) >= brute_thresh:
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"Possible brute force: {user}",
|
||||
severity="high",
|
||||
description=f"User '{user}' had {len(indices)} failed logins",
|
||||
evidence=[{"user": user, "failed_count": len(indices), "rows": indices[:10]}],
|
||||
mitre_technique="T1110",
|
||||
tags=["brute_force", "authentication"],
|
||||
score=min(90, 50 + len(indices) * 3),
|
||||
))
|
||||
|
||||
# Unusual logon types
|
||||
for ltype, indices in logon_types.items():
|
||||
label = "Network logon (Type 3)" if ltype == "3" else "Remote Desktop (Type 10)"
|
||||
if len(indices) >= 3:
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"{label} detected",
|
||||
severity="medium" if ltype == "3" else "high",
|
||||
description=f"{len(indices)} {label} events detected",
|
||||
evidence=[{"logon_type": ltype, "count": len(indices), "rows": indices[:10]}],
|
||||
mitre_technique="T1021",
|
||||
tags=["authentication", "lateral_movement"],
|
||||
score=55 if ltype == "3" else 70,
|
||||
))
|
||||
|
||||
return alerts
|
||||
|
||||
|
||||
class PersistenceAnalyzer(BaseAnalyzer):
|
||||
"""Detects persistence mechanisms (registry keys, services, scheduled tasks)."""
|
||||
|
||||
name = "persistence"
|
||||
description = "Flags persistence mechanism installations"
|
||||
|
||||
REGISTRY_PATTERNS = [
|
||||
(r"(?i)\\CurrentVersion\\Run", "Run key persistence", "T1547.001"),
|
||||
(r"(?i)\\Services\\", "Service installation", "T1543.003"),
|
||||
(r"(?i)\\Winlogon\\", "Winlogon persistence", "T1547.004"),
|
||||
(r"(?i)\\Image File Execution Options\\", "IFEO debugger persistence", "T1546.012"),
|
||||
(r"(?i)\\Explorer\\Shell Folders", "Shell folder hijack", "T1547.001"),
|
||||
]
|
||||
|
||||
async def analyze(self, rows, config=None):
|
||||
alerts: list[AlertCandidate] = []
|
||||
compiled = [(re.compile(p), t, m) for p, t, m in self.REGISTRY_PATTERNS]
|
||||
|
||||
for idx, row in enumerate(rows):
|
||||
# Check registry paths
|
||||
reg_path = str(row.get("registry_key", row.get("target_object", row.get("registry_path", ""))))
|
||||
for pattern, title, mitre in compiled:
|
||||
if pattern.search(reg_path):
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=title,
|
||||
severity="high",
|
||||
description=f"Row {idx}: {reg_path[:200]}",
|
||||
evidence=[{"row_index": idx, "registry_key": reg_path[:300]}],
|
||||
mitre_technique=mitre,
|
||||
tags=["persistence", "registry"],
|
||||
score=75,
|
||||
))
|
||||
|
||||
# Check for service creation events
|
||||
event_type = str(row.get("event_type", "")).lower()
|
||||
if "service" in event_type and "creat" in event_type:
|
||||
svc_name = row.get("service_name", row.get("target_filename", "unknown"))
|
||||
alerts.append(AlertCandidate(
|
||||
analyzer=self.name,
|
||||
title=f"Service created: {svc_name}",
|
||||
severity="medium",
|
||||
description=f"Row {idx}: New service '{svc_name}' created",
|
||||
evidence=[{"row_index": idx, "service_name": str(svc_name)}],
|
||||
mitre_technique="T1543.003",
|
||||
tags=["persistence", "service"],
|
||||
score=60,
|
||||
))
|
||||
|
||||
return alerts
|
||||
|
||||
|
||||
# ── Analyzer Registry ────────────────────────────────────────────────
|
||||
|
||||
|
||||
_ALL_ANALYZERS: list[BaseAnalyzer] = [
|
||||
EntropyAnalyzer(),
|
||||
SuspiciousCommandAnalyzer(),
|
||||
NetworkAnomalyAnalyzer(),
|
||||
FrequencyAnomalyAnalyzer(),
|
||||
AuthAnomalyAnalyzer(),
|
||||
PersistenceAnalyzer(),
|
||||
]
|
||||
|
||||
|
||||
def get_available_analyzers() -> list[dict[str, str]]:
|
||||
"""Return metadata about all registered analyzers."""
|
||||
return [{"name": a.name, "description": a.description} for a in _ALL_ANALYZERS]
|
||||
|
||||
|
||||
def get_analyzer(name: str) -> BaseAnalyzer | None:
|
||||
"""Get an analyzer by name."""
|
||||
for a in _ALL_ANALYZERS:
|
||||
if a.name == name:
|
||||
return a
|
||||
return None
|
||||
|
||||
|
||||
async def run_all_analyzers(
|
||||
rows: list[dict[str, Any]],
|
||||
enabled: list[str] | None = None,
|
||||
config: dict[str, Any] | None = None,
|
||||
) -> list[AlertCandidate]:
|
||||
"""Run all (or selected) analyzers and return combined alert candidates.
|
||||
|
||||
Args:
|
||||
rows: Flat list of row dicts (normalized_data or data from DatasetRow).
|
||||
enabled: Optional list of analyzer names to run. Runs all if None.
|
||||
config: Optional config overrides passed to each analyzer.
|
||||
|
||||
Returns:
|
||||
Combined list of AlertCandidate from all analyzers, sorted by score desc.
|
||||
"""
|
||||
config = config or {}
|
||||
results: list[AlertCandidate] = []
|
||||
|
||||
for analyzer in _ALL_ANALYZERS:
|
||||
if enabled and analyzer.name not in enabled:
|
||||
continue
|
||||
try:
|
||||
candidates = await analyzer.analyze(rows, config)
|
||||
results.extend(candidates)
|
||||
logger.info("Analyzer %s produced %d alerts", analyzer.name, len(candidates))
|
||||
except Exception:
|
||||
logger.exception("Analyzer %s failed", analyzer.name)
|
||||
|
||||
# Sort by score descending
|
||||
results.sort(key=lambda a: a.score, reverse=True)
|
||||
return results
|
||||
322
backend/app/services/llm_analysis.py
Normal file
322
backend/app/services/llm_analysis.py
Normal file
@@ -0,0 +1,322 @@
|
||||
"""LLM-powered dataset analysis — replaces manual IOC enrichment.
|
||||
|
||||
Loads dataset rows server-side, builds a concise summary, and sends it
|
||||
to Wile (70B heavy) or Roadrunner (fast) for threat analysis.
|
||||
Supports both single-dataset and hunt-wide analysis.
|
||||
"""
|
||||
|
||||
import asyncio
|
||||
import json
|
||||
import logging
|
||||
import time
|
||||
from collections import Counter, defaultdict
|
||||
from typing import Any, Optional
|
||||
|
||||
from pydantic import BaseModel, Field
|
||||
|
||||
from app.config import settings
|
||||
from app.agents.providers_v2 import OllamaProvider
|
||||
from app.agents.router import TaskType, task_router
|
||||
from app.services.sans_rag import sans_rag
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ── Request / Response models ─────────────────────────────────────────
|
||||
|
||||
|
||||
class AnalysisRequest(BaseModel):
|
||||
"""Request for LLM-powered analysis of a dataset."""
|
||||
dataset_id: Optional[str] = None
|
||||
hunt_id: Optional[str] = None
|
||||
question: str = Field(
|
||||
default="Perform a comprehensive threat analysis of this dataset. "
|
||||
"Identify anomalies, suspicious patterns, potential IOCs, and recommend "
|
||||
"next steps for the analyst.",
|
||||
description="Specific question or general analysis request",
|
||||
)
|
||||
mode: str = Field(default="deep", description="quick | deep")
|
||||
focus: Optional[str] = Field(
|
||||
None,
|
||||
description="Focus area: threats, anomalies, lateral_movement, exfil, persistence, recon",
|
||||
)
|
||||
|
||||
|
||||
class AnalysisResult(BaseModel):
|
||||
"""LLM analysis result."""
|
||||
analysis: str = Field(..., description="Full analysis text (markdown)")
|
||||
confidence: float = Field(default=0.0, description="0-1 confidence")
|
||||
key_findings: list[str] = Field(default_factory=list)
|
||||
iocs_identified: list[dict] = Field(default_factory=list)
|
||||
recommended_actions: list[str] = Field(default_factory=list)
|
||||
mitre_techniques: list[str] = Field(default_factory=list)
|
||||
risk_score: int = Field(default=0, description="0-100 risk score")
|
||||
model_used: str = ""
|
||||
node_used: str = ""
|
||||
latency_ms: int = 0
|
||||
rows_analyzed: int = 0
|
||||
dataset_summary: str = ""
|
||||
|
||||
|
||||
# ── Analysis prompts ──────────────────────────────────────────────────
|
||||
|
||||
ANALYSIS_SYSTEM = """You are an expert threat hunter and incident response analyst.
|
||||
You are analyzing CSV log data from forensic tools (Velociraptor, Sysmon, etc.).
|
||||
|
||||
Your task: Perform deep threat analysis of the data provided and produce actionable findings.
|
||||
|
||||
RESPOND WITH VALID JSON ONLY:
|
||||
{
|
||||
"analysis": "Detailed markdown analysis with headers and bullet points",
|
||||
"confidence": 0.85,
|
||||
"key_findings": ["Finding 1", "Finding 2"],
|
||||
"iocs_identified": [{"type": "ip", "value": "1.2.3.4", "context": "C2 traffic"}],
|
||||
"recommended_actions": ["Action 1", "Action 2"],
|
||||
"mitre_techniques": ["T1059.001 - PowerShell", "T1071 - Application Layer Protocol"],
|
||||
"risk_score": 65
|
||||
}
|
||||
"""
|
||||
|
||||
FOCUS_PROMPTS = {
|
||||
"threats": "Focus on identifying active threats, malware indicators, and attack patterns.",
|
||||
"anomalies": "Focus on statistical anomalies, outliers, and unusual behavior patterns.",
|
||||
"lateral_movement": "Focus on evidence of lateral movement: PsExec, WMI, RDP, SMB, pass-the-hash.",
|
||||
"exfil": "Focus on data exfiltration indicators: large transfers, DNS tunneling, unusual destinations.",
|
||||
"persistence": "Focus on persistence mechanisms: scheduled tasks, services, registry, startup items.",
|
||||
"recon": "Focus on reconnaissance activity: scanning, enumeration, discovery commands.",
|
||||
}
|
||||
|
||||
|
||||
# ── Data summarizer ───────────────────────────────────────────────────
|
||||
|
||||
|
||||
def summarize_dataset_rows(
|
||||
rows: list[dict],
|
||||
columns: list[str] | None = None,
|
||||
max_sample: int = 20,
|
||||
max_chars: int = 6000,
|
||||
) -> str:
|
||||
"""Build a concise text summary of dataset rows for LLM consumption.
|
||||
|
||||
Includes:
|
||||
- Column headers and types
|
||||
- Statistical summary (unique values, top values per column)
|
||||
- Sample rows (first N)
|
||||
- Detected patterns of interest
|
||||
"""
|
||||
if not rows:
|
||||
return "Empty dataset — no rows to analyze."
|
||||
|
||||
cols = columns or list(rows[0].keys())
|
||||
n_rows = len(rows)
|
||||
|
||||
parts: list[str] = []
|
||||
parts.append(f"## Dataset Summary: {n_rows} rows, {len(cols)} columns")
|
||||
parts.append(f"Columns: {', '.join(cols)}")
|
||||
|
||||
# Per-column stats
|
||||
parts.append("\n### Column Statistics:")
|
||||
for col in cols[:30]: # limit to first 30 cols
|
||||
values = [str(r.get(col, "")) for r in rows if r.get(col) not in (None, "", "N/A")]
|
||||
if not values:
|
||||
continue
|
||||
unique = len(set(values))
|
||||
counter = Counter(values)
|
||||
top3 = counter.most_common(3)
|
||||
top_str = ", ".join(f"{v} ({c}x)" for v, c in top3)
|
||||
parts.append(f"- **{col}**: {len(values)} non-null, {unique} unique. Top: {top_str}")
|
||||
|
||||
# Sample rows
|
||||
sample = rows[:max_sample]
|
||||
parts.append(f"\n### Sample Rows (first {len(sample)}):")
|
||||
for i, row in enumerate(sample):
|
||||
row_str = " | ".join(f"{k}={v}" for k, v in row.items() if v not in (None, "", "N/A"))
|
||||
parts.append(f"{i+1}. {row_str}")
|
||||
|
||||
# Detect interesting patterns
|
||||
patterns: list[str] = []
|
||||
all_cmds = [str(r.get("command_line", "")).lower() for r in rows if r.get("command_line")]
|
||||
sus_cmds = [c for c in all_cmds if any(
|
||||
k in c for k in ["powershell -enc", "certutil", "bitsadmin", "mshta",
|
||||
"regsvr32", "invoke-", "mimikatz", "psexec"]
|
||||
)]
|
||||
if sus_cmds:
|
||||
patterns.append(f"⚠️ {len(sus_cmds)} suspicious command lines detected")
|
||||
|
||||
all_ips = [str(r.get("dst_ip", "")) for r in rows if r.get("dst_ip")]
|
||||
ext_ips = [ip for ip in all_ips if ip and not ip.startswith(("10.", "192.168.", "172.", "127."))]
|
||||
if ext_ips:
|
||||
unique_ext = len(set(ext_ips))
|
||||
patterns.append(f"🌐 {unique_ext} unique external destination IPs")
|
||||
|
||||
if patterns:
|
||||
parts.append("\n### Detected Patterns:")
|
||||
for p in patterns:
|
||||
parts.append(f"- {p}")
|
||||
|
||||
text = "\n".join(parts)
|
||||
if len(text) > max_chars:
|
||||
text = text[:max_chars] + "\n... (truncated)"
|
||||
return text
|
||||
|
||||
|
||||
# ── LLM analysis engine ──────────────────────────────────────────────
|
||||
|
||||
|
||||
async def run_llm_analysis(
|
||||
rows: list[dict],
|
||||
request: AnalysisRequest,
|
||||
dataset_name: str = "unknown",
|
||||
) -> AnalysisResult:
|
||||
"""Run LLM analysis on dataset rows."""
|
||||
start = time.monotonic()
|
||||
|
||||
# Build summary
|
||||
summary = summarize_dataset_rows(rows)
|
||||
|
||||
# Route to appropriate model
|
||||
task_type = TaskType.DEEP_ANALYSIS if request.mode == "deep" else TaskType.QUICK_CHAT
|
||||
decision = task_router.route(task_type)
|
||||
|
||||
# Build prompt
|
||||
focus_text = FOCUS_PROMPTS.get(request.focus or "", "")
|
||||
prompt = f"""Analyze the following forensic dataset from '{dataset_name}'.
|
||||
|
||||
{focus_text}
|
||||
|
||||
Analyst question: {request.question}
|
||||
|
||||
{summary}
|
||||
"""
|
||||
|
||||
# Enrich with SANS RAG
|
||||
try:
|
||||
rag_context = await sans_rag.enrich_prompt(
|
||||
request.question,
|
||||
investigation_context=f"Analyzing {len(rows)} rows from {dataset_name}",
|
||||
)
|
||||
if rag_context:
|
||||
prompt = f"{prompt}\n\n{rag_context}"
|
||||
except Exception as e:
|
||||
logger.warning(f"SANS RAG enrichment failed: {e}")
|
||||
|
||||
# Call LLM
|
||||
provider = task_router.get_provider(decision)
|
||||
messages = [
|
||||
{"role": "system", "content": ANALYSIS_SYSTEM},
|
||||
{"role": "user", "content": prompt},
|
||||
]
|
||||
|
||||
try:
|
||||
raw = await asyncio.wait_for(
|
||||
provider.generate(
|
||||
prompt=prompt,
|
||||
system=ANALYSIS_SYSTEM,
|
||||
max_tokens=settings.AGENT_MAX_TOKENS * 2, # longer for analysis
|
||||
temperature=0.3,
|
||||
),
|
||||
timeout=300, # 5 min hard limit
|
||||
)
|
||||
except asyncio.TimeoutError:
|
||||
logger.error("LLM analysis timed out after 300s")
|
||||
return AnalysisResult(
|
||||
analysis="Analysis timed out after 5 minutes. Try a smaller dataset or 'quick' mode.",
|
||||
model_used=decision.model,
|
||||
node_used=decision.node,
|
||||
latency_ms=int((time.monotonic() - start) * 1000),
|
||||
rows_analyzed=len(rows),
|
||||
dataset_summary=summary,
|
||||
)
|
||||
except Exception as e:
|
||||
logger.error(f"LLM analysis failed: {e}")
|
||||
return AnalysisResult(
|
||||
analysis=f"Analysis failed: {str(e)}",
|
||||
model_used=decision.model,
|
||||
node_used=decision.node,
|
||||
latency_ms=int((time.monotonic() - start) * 1000),
|
||||
rows_analyzed=len(rows),
|
||||
dataset_summary=summary,
|
||||
)
|
||||
|
||||
elapsed = int((time.monotonic() - start) * 1000)
|
||||
|
||||
# Parse JSON response
|
||||
result = _parse_analysis(raw)
|
||||
result.model_used = decision.model
|
||||
result.node_used = decision.node
|
||||
result.latency_ms = elapsed
|
||||
result.rows_analyzed = len(rows)
|
||||
result.dataset_summary = summary
|
||||
|
||||
return result
|
||||
|
||||
|
||||
def _parse_analysis(raw) -> AnalysisResult:
|
||||
"""Try to parse LLM output as JSON, fall back to plain text.
|
||||
|
||||
raw may be:
|
||||
- A dict from OllamaProvider.generate() with key "response" containing LLM text
|
||||
- A plain string from other providers
|
||||
"""
|
||||
# Ollama provider returns {"response": "<llm text>", "model": ..., ...}
|
||||
if isinstance(raw, dict):
|
||||
text = raw.get("response") or raw.get("analysis") or str(raw)
|
||||
logger.info(f"_parse_analysis: extracted text from dict, len={len(text)}, first 200 chars: {text[:200]}")
|
||||
else:
|
||||
text = str(raw)
|
||||
logger.info(f"_parse_analysis: raw is str, len={len(text)}, first 200 chars: {text[:200]}")
|
||||
|
||||
text = text.strip()
|
||||
|
||||
# Strip markdown code fences
|
||||
if text.startswith("```"):
|
||||
lines = text.split("\n")
|
||||
lines = [l for l in lines if not l.strip().startswith("```")]
|
||||
text = "\n".join(lines).strip()
|
||||
|
||||
# Try direct JSON parse first
|
||||
for candidate in _extract_json_candidates(text):
|
||||
try:
|
||||
data = json.loads(candidate)
|
||||
if isinstance(data, dict):
|
||||
logger.info(f"_parse_analysis: parsed JSON OK, keys={list(data.keys())}")
|
||||
return AnalysisResult(
|
||||
analysis=data.get("analysis", text),
|
||||
confidence=float(data.get("confidence", 0.5)),
|
||||
key_findings=data.get("key_findings", []),
|
||||
iocs_identified=data.get("iocs_identified", []),
|
||||
recommended_actions=data.get("recommended_actions", []),
|
||||
mitre_techniques=data.get("mitre_techniques", []),
|
||||
risk_score=int(data.get("risk_score", 0)),
|
||||
)
|
||||
except (json.JSONDecodeError, ValueError) as e:
|
||||
logger.warning(f"_parse_analysis: JSON parse failed: {e}, candidate len={len(candidate)}, first 100: {candidate[:100]}")
|
||||
continue
|
||||
|
||||
# Fallback: plain text
|
||||
logger.warning(f"_parse_analysis: all JSON parse attempts failed, falling back to plain text")
|
||||
return AnalysisResult(
|
||||
analysis=text,
|
||||
confidence=0.5,
|
||||
)
|
||||
|
||||
|
||||
def _extract_json_candidates(text: str):
|
||||
"""Yield JSON candidate strings from text, trying progressively more aggressive extraction."""
|
||||
import re
|
||||
|
||||
# 1. The whole text as-is
|
||||
yield text
|
||||
|
||||
# 2. Find outermost { ... } block
|
||||
start = text.find("{")
|
||||
end = text.rfind("}")
|
||||
if start != -1 and end > start:
|
||||
block = text[start:end + 1]
|
||||
yield block
|
||||
|
||||
# 3. Try to fix common LLM JSON issues:
|
||||
# - trailing commas before ] or }
|
||||
fixed = re.sub(r',\s*([}\]])', r'\1', block)
|
||||
if fixed != block:
|
||||
yield fixed
|
||||
484
backend/app/services/mitre.py
Normal file
484
backend/app/services/mitre.py
Normal file
@@ -0,0 +1,484 @@
|
||||
"""
|
||||
MITRE ATT&CK mapping service.
|
||||
|
||||
Maps dataset events to ATT&CK techniques using pattern-based heuristics.
|
||||
Uses the enterprise-attack matrix (embedded patterns for offline use).
|
||||
"""
|
||||
|
||||
import logging
|
||||
import re
|
||||
from collections import Counter, defaultdict
|
||||
from typing import Any
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db.models import Dataset, DatasetRow
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# ── ATT&CK Technique Patterns ────────────────────────────────────────
|
||||
# Subset of enterprise-attack techniques with detection patterns.
|
||||
# Each entry: (technique_id, name, tactic, patterns_list)
|
||||
|
||||
TECHNIQUE_PATTERNS: list[tuple[str, str, str, list[str]]] = [
|
||||
# Initial Access
|
||||
("T1566", "Phishing", "initial-access", [
|
||||
r"phish", r"\.hta\b", r"\.lnk\b", r"mshta\.exe", r"outlook.*attachment",
|
||||
]),
|
||||
("T1190", "Exploit Public-Facing Application", "initial-access", [
|
||||
r"exploit", r"CVE-\d{4}", r"vulnerability", r"webshell",
|
||||
]),
|
||||
|
||||
# Execution
|
||||
("T1059.001", "PowerShell", "execution", [
|
||||
r"powershell", r"pwsh", r"-enc\b", r"-encodedcommand",
|
||||
r"invoke-expression", r"iex\b", r"bypass\b.*execution",
|
||||
]),
|
||||
("T1059.003", "Windows Command Shell", "execution", [
|
||||
r"cmd\.exe", r"/c\s+", r"command\.com",
|
||||
]),
|
||||
("T1059.005", "Visual Basic", "execution", [
|
||||
r"wscript", r"cscript", r"\.vbs\b", r"\.vbe\b",
|
||||
]),
|
||||
("T1047", "Windows Management Instrumentation", "execution", [
|
||||
r"wmic\b", r"winmgmt", r"wmi\b",
|
||||
]),
|
||||
("T1053.005", "Scheduled Task", "execution", [
|
||||
r"schtasks", r"at\.exe", r"taskschd",
|
||||
]),
|
||||
("T1204", "User Execution", "execution", [
|
||||
r"user.*click", r"open.*attachment", r"macro",
|
||||
]),
|
||||
|
||||
# Persistence
|
||||
("T1547.001", "Registry Run Keys", "persistence", [
|
||||
r"CurrentVersion\\Run", r"HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run",
|
||||
r"reg\s+add.*\\Run",
|
||||
]),
|
||||
("T1543.003", "Windows Service", "persistence", [
|
||||
r"sc\s+create", r"new-service", r"service.*install",
|
||||
]),
|
||||
("T1136", "Create Account", "persistence", [
|
||||
r"net\s+user\s+/add", r"new-localuser", r"useradd",
|
||||
]),
|
||||
("T1053.005", "Scheduled Task/Job", "persistence", [
|
||||
r"schtasks\s+/create", r"crontab",
|
||||
]),
|
||||
|
||||
# Privilege Escalation
|
||||
("T1548.002", "Bypass User Access Control", "privilege-escalation", [
|
||||
r"eventvwr", r"fodhelper", r"uac.*bypass", r"computerdefaults",
|
||||
]),
|
||||
("T1134", "Access Token Manipulation", "privilege-escalation", [
|
||||
r"token.*impersonat", r"runas", r"adjusttokenprivileges",
|
||||
]),
|
||||
|
||||
# Defense Evasion
|
||||
("T1070.001", "Clear Windows Event Logs", "defense-evasion", [
|
||||
r"wevtutil\s+cl", r"clear-eventlog", r"clearlog",
|
||||
]),
|
||||
("T1562.001", "Disable or Modify Tools", "defense-evasion", [
|
||||
r"tamper.*protection", r"disable.*defender", r"set-mppreference",
|
||||
r"disable.*firewall",
|
||||
]),
|
||||
("T1027", "Obfuscated Files or Information", "defense-evasion", [
|
||||
r"base64", r"-enc\b", r"certutil.*-decode", r"frombase64",
|
||||
]),
|
||||
("T1036", "Masquerading", "defense-evasion", [
|
||||
r"rename.*\.exe", r"masquerad", r"svchost.*unusual",
|
||||
]),
|
||||
("T1055", "Process Injection", "defense-evasion", [
|
||||
r"inject", r"createremotethread", r"ntcreatethreadex",
|
||||
r"virtualalloc", r"writeprocessmemory",
|
||||
]),
|
||||
|
||||
# Credential Access
|
||||
("T1003.001", "LSASS Memory", "credential-access", [
|
||||
r"mimikatz", r"sekurlsa", r"lsass", r"procdump.*lsass",
|
||||
]),
|
||||
("T1003.003", "NTDS", "credential-access", [
|
||||
r"ntds\.dit", r"vssadmin.*shadow", r"ntdsutil",
|
||||
]),
|
||||
("T1110", "Brute Force", "credential-access", [
|
||||
r"brute.*force", r"failed.*login.*\d{3,}", r"hydra", r"medusa",
|
||||
]),
|
||||
("T1558.003", "Kerberoasting", "credential-access", [
|
||||
r"kerberoast", r"invoke-kerberoast", r"GetUserSPNs",
|
||||
]),
|
||||
|
||||
# Discovery
|
||||
("T1087", "Account Discovery", "discovery", [
|
||||
r"net\s+user", r"net\s+localgroup", r"get-aduser",
|
||||
]),
|
||||
("T1082", "System Information Discovery", "discovery", [
|
||||
r"systeminfo", r"hostname", r"ver\b",
|
||||
]),
|
||||
("T1083", "File and Directory Discovery", "discovery", [
|
||||
r"dir\s+/s", r"tree\s+/f", r"get-childitem.*-recurse",
|
||||
]),
|
||||
("T1057", "Process Discovery", "discovery", [
|
||||
r"tasklist", r"get-process", r"ps\s+aux",
|
||||
]),
|
||||
("T1018", "Remote System Discovery", "discovery", [
|
||||
r"net\s+view", r"ping\s+-", r"arp\s+-a", r"nslookup",
|
||||
]),
|
||||
("T1016", "System Network Configuration Discovery", "discovery", [
|
||||
r"ipconfig", r"ifconfig", r"netstat",
|
||||
]),
|
||||
|
||||
# Lateral Movement
|
||||
("T1021.001", "Remote Desktop Protocol", "lateral-movement", [
|
||||
r"rdp\b", r"mstsc", r"3389", r"remote\s+desktop",
|
||||
]),
|
||||
("T1021.002", "SMB/Windows Admin Shares", "lateral-movement", [
|
||||
r"\\\\.*\\(c|admin)\$", r"psexec", r"smbclient", r"net\s+use",
|
||||
]),
|
||||
("T1021.006", "Windows Remote Management", "lateral-movement", [
|
||||
r"winrm", r"enter-pssession", r"invoke-command.*-computername",
|
||||
r"wsman", r"5985|5986",
|
||||
]),
|
||||
("T1570", "Lateral Tool Transfer", "lateral-movement", [
|
||||
r"copy.*\\\\", r"xcopy.*\\\\", r"robocopy",
|
||||
]),
|
||||
|
||||
# Collection
|
||||
("T1560", "Archive Collected Data", "collection", [
|
||||
r"compress-archive", r"7z\.exe", r"rar\s+a", r"tar\s+-[cz]",
|
||||
]),
|
||||
("T1005", "Data from Local System", "collection", [
|
||||
r"type\s+.*password", r"findstr.*password", r"select-string.*credential",
|
||||
]),
|
||||
|
||||
# Command and Control
|
||||
("T1071.001", "Web Protocols", "command-and-control", [
|
||||
r"http[s]?://\d+\.\d+\.\d+\.\d+", r"curl\b", r"wget\b",
|
||||
r"invoke-webrequest", r"beacon",
|
||||
]),
|
||||
("T1573", "Encrypted Channel", "command-and-control", [
|
||||
r"ssl\b", r"tls\b", r"encrypted.*tunnel", r"stunnel",
|
||||
]),
|
||||
("T1105", "Ingress Tool Transfer", "command-and-control", [
|
||||
r"certutil.*-urlcache", r"bitsadmin.*transfer",
|
||||
r"downloadfile", r"invoke-webrequest.*-outfile",
|
||||
]),
|
||||
("T1219", "Remote Access Software", "command-and-control", [
|
||||
r"teamviewer", r"anydesk", r"logmein", r"vnc",
|
||||
]),
|
||||
|
||||
# Exfiltration
|
||||
("T1048", "Exfiltration Over Alternative Protocol", "exfiltration", [
|
||||
r"dns.*tunnel", r"exfil", r"icmp.*tunnel",
|
||||
]),
|
||||
("T1041", "Exfiltration Over C2 Channel", "exfiltration", [
|
||||
r"upload.*c2", r"exfil.*http",
|
||||
]),
|
||||
("T1567", "Exfiltration Over Web Service", "exfiltration", [
|
||||
r"mega\.nz", r"dropbox", r"pastebin", r"transfer\.sh",
|
||||
]),
|
||||
|
||||
# Impact
|
||||
("T1486", "Data Encrypted for Impact", "impact", [
|
||||
r"ransomware", r"encrypt.*files", r"\.locked\b", r"ransom",
|
||||
]),
|
||||
("T1489", "Service Stop", "impact", [
|
||||
r"sc\s+stop", r"net\s+stop", r"stop-service",
|
||||
]),
|
||||
("T1529", "System Shutdown/Reboot", "impact", [
|
||||
r"shutdown\s+/[rs]", r"restart-computer",
|
||||
]),
|
||||
]
|
||||
|
||||
# Tactic display names and kill-chain order
|
||||
TACTIC_ORDER = [
|
||||
"initial-access", "execution", "persistence", "privilege-escalation",
|
||||
"defense-evasion", "credential-access", "discovery", "lateral-movement",
|
||||
"collection", "command-and-control", "exfiltration", "impact",
|
||||
]
|
||||
TACTIC_NAMES = {
|
||||
"initial-access": "Initial Access",
|
||||
"execution": "Execution",
|
||||
"persistence": "Persistence",
|
||||
"privilege-escalation": "Privilege Escalation",
|
||||
"defense-evasion": "Defense Evasion",
|
||||
"credential-access": "Credential Access",
|
||||
"discovery": "Discovery",
|
||||
"lateral-movement": "Lateral Movement",
|
||||
"collection": "Collection",
|
||||
"command-and-control": "Command and Control",
|
||||
"exfiltration": "Exfiltration",
|
||||
"impact": "Impact",
|
||||
}
|
||||
|
||||
|
||||
# ── Row fetcher ───────────────────────────────────────────────────────
|
||||
|
||||
async def _fetch_rows(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
limit: int = 5000,
|
||||
) -> list[dict[str, Any]]:
|
||||
q = select(DatasetRow).join(Dataset)
|
||||
if dataset_id:
|
||||
q = q.where(DatasetRow.dataset_id == dataset_id)
|
||||
elif hunt_id:
|
||||
q = q.where(Dataset.hunt_id == hunt_id)
|
||||
q = q.limit(limit)
|
||||
result = await db.execute(q)
|
||||
return [r.data for r in result.scalars().all()]
|
||||
|
||||
|
||||
# ── Main functions ────────────────────────────────────────────────────
|
||||
|
||||
async def map_to_attack(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
) -> dict[str, Any]:
|
||||
"""
|
||||
Map dataset rows to MITRE ATT&CK techniques.
|
||||
Returns a matrix-style structure + evidence list.
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id, hunt_id)
|
||||
if not rows:
|
||||
return {"tactics": [], "techniques": [], "evidence": [], "coverage": {}, "total_rows": 0}
|
||||
|
||||
# Flatten all string values per row for matching
|
||||
row_texts: list[str] = []
|
||||
for row in rows:
|
||||
parts = []
|
||||
for v in row.values():
|
||||
if v is not None:
|
||||
parts.append(str(v).lower())
|
||||
row_texts.append(" ".join(parts))
|
||||
|
||||
# Match techniques
|
||||
technique_hits: dict[str, list[dict]] = defaultdict(list) # tech_id -> evidence rows
|
||||
technique_meta: dict[str, tuple[str, str]] = {} # tech_id -> (name, tactic)
|
||||
row_techniques: list[set[str]] = [set() for _ in rows]
|
||||
|
||||
for tech_id, tech_name, tactic, patterns in TECHNIQUE_PATTERNS:
|
||||
compiled = [re.compile(p, re.IGNORECASE) for p in patterns]
|
||||
technique_meta[tech_id] = (tech_name, tactic)
|
||||
for i, text in enumerate(row_texts):
|
||||
for pat in compiled:
|
||||
if pat.search(text):
|
||||
row_techniques[i].add(tech_id)
|
||||
if len(technique_hits[tech_id]) < 10: # limit evidence
|
||||
# find matching field
|
||||
matched_field = ""
|
||||
matched_value = ""
|
||||
for k, v in rows[i].items():
|
||||
if v and pat.search(str(v).lower()):
|
||||
matched_field = k
|
||||
matched_value = str(v)[:200]
|
||||
break
|
||||
technique_hits[tech_id].append({
|
||||
"row_index": i,
|
||||
"field": matched_field,
|
||||
"value": matched_value,
|
||||
"pattern": pat.pattern,
|
||||
})
|
||||
break # one pattern match per technique per row is enough
|
||||
|
||||
# Build tactic → technique structure
|
||||
tactic_techniques: dict[str, list[dict]] = defaultdict(list)
|
||||
for tech_id, evidence_list in technique_hits.items():
|
||||
name, tactic = technique_meta[tech_id]
|
||||
tactic_techniques[tactic].append({
|
||||
"id": tech_id,
|
||||
"name": name,
|
||||
"count": len(evidence_list),
|
||||
"evidence": evidence_list[:5],
|
||||
})
|
||||
|
||||
# Build ordered tactics list
|
||||
tactics = []
|
||||
for tactic_key in TACTIC_ORDER:
|
||||
techs = tactic_techniques.get(tactic_key, [])
|
||||
tactics.append({
|
||||
"id": tactic_key,
|
||||
"name": TACTIC_NAMES.get(tactic_key, tactic_key),
|
||||
"techniques": sorted(techs, key=lambda t: -t["count"]),
|
||||
"total_hits": sum(t["count"] for t in techs),
|
||||
})
|
||||
|
||||
# Coverage stats
|
||||
covered_tactics = sum(1 for t in tactics if t["total_hits"] > 0)
|
||||
total_technique_hits = sum(t["total_hits"] for t in tactics)
|
||||
|
||||
return {
|
||||
"tactics": tactics,
|
||||
"coverage": {
|
||||
"tactics_covered": covered_tactics,
|
||||
"tactics_total": len(TACTIC_ORDER),
|
||||
"techniques_matched": len(technique_hits),
|
||||
"total_evidence": total_technique_hits,
|
||||
},
|
||||
"total_rows": len(rows),
|
||||
}
|
||||
|
||||
|
||||
async def build_knowledge_graph(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
) -> dict[str, Any]:
|
||||
"""
|
||||
Build a knowledge graph connecting entities (hosts, users, processes, IPs)
|
||||
to MITRE techniques and tactics.
|
||||
Returns Cytoscape-compatible nodes + edges.
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id, hunt_id)
|
||||
if not rows:
|
||||
return {"nodes": [], "edges": [], "stats": {}}
|
||||
|
||||
# Extract entities
|
||||
entities: dict[str, set[str]] = defaultdict(set) # type -> set of values
|
||||
row_entity_map: list[list[tuple[str, str]]] = [] # per-row list of (type, value)
|
||||
|
||||
# Field name patterns for entity extraction
|
||||
HOST_FIELDS = re.compile(r"hostname|computer|host|machine", re.I)
|
||||
USER_FIELDS = re.compile(r"user|account|logon.*name|subject.*name", re.I)
|
||||
IP_FIELDS = re.compile(r"src.*ip|dst.*ip|ip.*addr|source.*ip|dest.*ip|remote.*addr", re.I)
|
||||
PROC_FIELDS = re.compile(r"process.*name|image|parent.*image|executable|command", re.I)
|
||||
|
||||
for row in rows:
|
||||
row_ents: list[tuple[str, str]] = []
|
||||
for k, v in row.items():
|
||||
if not v or str(v).strip() in ('', '-', 'N/A', 'None'):
|
||||
continue
|
||||
val = str(v).strip()
|
||||
if HOST_FIELDS.search(k):
|
||||
entities["host"].add(val)
|
||||
row_ents.append(("host", val))
|
||||
elif USER_FIELDS.search(k):
|
||||
entities["user"].add(val)
|
||||
row_ents.append(("user", val))
|
||||
elif IP_FIELDS.search(k):
|
||||
entities["ip"].add(val)
|
||||
row_ents.append(("ip", val))
|
||||
elif PROC_FIELDS.search(k):
|
||||
# Clean process name
|
||||
pname = val.split("\\")[-1].split("/")[-1][:60]
|
||||
entities["process"].add(pname)
|
||||
row_ents.append(("process", pname))
|
||||
row_entity_map.append(row_ents)
|
||||
|
||||
# Map rows to techniques
|
||||
row_texts = [" ".join(str(v).lower() for v in row.values() if v) for row in rows]
|
||||
row_techniques: list[set[str]] = [set() for _ in rows]
|
||||
tech_meta: dict[str, tuple[str, str]] = {}
|
||||
|
||||
for tech_id, tech_name, tactic, patterns in TECHNIQUE_PATTERNS:
|
||||
compiled = [re.compile(p, re.I) for p in patterns]
|
||||
tech_meta[tech_id] = (tech_name, tactic)
|
||||
for i, text in enumerate(row_texts):
|
||||
for pat in compiled:
|
||||
if pat.search(text):
|
||||
row_techniques[i].add(tech_id)
|
||||
break
|
||||
|
||||
# Build graph
|
||||
nodes: list[dict] = []
|
||||
edges: list[dict] = []
|
||||
node_ids: set[str] = set()
|
||||
edge_counter: Counter = Counter()
|
||||
|
||||
# Entity nodes
|
||||
TYPE_COLORS = {
|
||||
"host": "#3b82f6",
|
||||
"user": "#10b981",
|
||||
"ip": "#8b5cf6",
|
||||
"process": "#f59e0b",
|
||||
"technique": "#ef4444",
|
||||
"tactic": "#6366f1",
|
||||
}
|
||||
TYPE_SHAPES = {
|
||||
"host": "roundrectangle",
|
||||
"user": "ellipse",
|
||||
"ip": "diamond",
|
||||
"process": "hexagon",
|
||||
"technique": "tag",
|
||||
"tactic": "round-rectangle",
|
||||
}
|
||||
|
||||
for ent_type, values in entities.items():
|
||||
for val in list(values)[:50]: # limit nodes
|
||||
nid = f"{ent_type}:{val}"
|
||||
if nid not in node_ids:
|
||||
node_ids.add(nid)
|
||||
nodes.append({
|
||||
"data": {
|
||||
"id": nid,
|
||||
"label": val[:40],
|
||||
"type": ent_type,
|
||||
"color": TYPE_COLORS.get(ent_type, "#666"),
|
||||
"shape": TYPE_SHAPES.get(ent_type, "ellipse"),
|
||||
},
|
||||
})
|
||||
|
||||
# Technique nodes
|
||||
seen_techniques: set[str] = set()
|
||||
for tech_set in row_techniques:
|
||||
seen_techniques.update(tech_set)
|
||||
|
||||
for tech_id in seen_techniques:
|
||||
name, tactic = tech_meta.get(tech_id, (tech_id, "unknown"))
|
||||
nid = f"technique:{tech_id}"
|
||||
if nid not in node_ids:
|
||||
node_ids.add(nid)
|
||||
nodes.append({
|
||||
"data": {
|
||||
"id": nid,
|
||||
"label": f"{tech_id}\n{name}",
|
||||
"type": "technique",
|
||||
"color": TYPE_COLORS["technique"],
|
||||
"shape": TYPE_SHAPES["technique"],
|
||||
"tactic": tactic,
|
||||
},
|
||||
})
|
||||
|
||||
# Edges: entity → technique (based on co-occurrence in rows)
|
||||
for i, row_ents in enumerate(row_entity_map):
|
||||
for ent_type, ent_val in row_ents:
|
||||
for tech_id in row_techniques[i]:
|
||||
src = f"{ent_type}:{ent_val}"
|
||||
tgt = f"technique:{tech_id}"
|
||||
if src in node_ids and tgt in node_ids:
|
||||
edge_key = (src, tgt)
|
||||
edge_counter[edge_key] += 1
|
||||
|
||||
# Edges: entity → entity (based on co-occurrence)
|
||||
for row_ents in row_entity_map:
|
||||
for j in range(len(row_ents)):
|
||||
for k in range(j + 1, len(row_ents)):
|
||||
src = f"{row_ents[j][0]}:{row_ents[j][1]}"
|
||||
tgt = f"{row_ents[k][0]}:{row_ents[k][1]}"
|
||||
if src in node_ids and tgt in node_ids and src != tgt:
|
||||
edge_counter[(src, tgt)] += 1
|
||||
|
||||
# Build edge list (filter low-weight edges)
|
||||
for (src, tgt), weight in edge_counter.most_common(500):
|
||||
if weight < 1:
|
||||
continue
|
||||
edges.append({
|
||||
"data": {
|
||||
"source": src,
|
||||
"target": tgt,
|
||||
"weight": weight,
|
||||
"label": str(weight) if weight > 2 else "",
|
||||
},
|
||||
})
|
||||
|
||||
return {
|
||||
"nodes": nodes,
|
||||
"edges": edges,
|
||||
"stats": {
|
||||
"total_nodes": len(nodes),
|
||||
"total_edges": len(edges),
|
||||
"entity_counts": {t: len(v) for t, v in entities.items()},
|
||||
"techniques_found": len(seen_techniques),
|
||||
},
|
||||
}
|
||||
252
backend/app/services/network_inventory.py
Normal file
252
backend/app/services/network_inventory.py
Normal file
@@ -0,0 +1,252 @@
|
||||
"""Network Picture — deduplicated host inventory built from dataset rows.
|
||||
|
||||
Scans all datasets in a hunt, extracts host-identifying fields from
|
||||
normalized data, and groups by hostname (or src_ip fallback) to produce
|
||||
a clean one-row-per-host inventory. Uses sets for deduplication —
|
||||
if an IP appears 900 times, it shows once.
|
||||
"""
|
||||
|
||||
import logging
|
||||
from datetime import datetime
|
||||
from typing import Any, Sequence
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db.models import Dataset, DatasetRow
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# Canonical column names we extract per row
|
||||
_HOST_KEYS = ("hostname",)
|
||||
_IP_KEYS = ("src_ip", "dst_ip", "ip_address")
|
||||
_USER_KEYS = ("username",)
|
||||
_OS_KEYS = ("os",)
|
||||
_MAC_KEYS = ("mac_address",)
|
||||
_PORT_SRC_KEYS = ("src_port",)
|
||||
_PORT_DST_KEYS = ("dst_port",)
|
||||
_PROTO_KEYS = ("protocol",)
|
||||
_STATE_KEYS = ("connection_state",)
|
||||
_TS_KEYS = ("timestamp",)
|
||||
|
||||
# Junk values to skip
|
||||
_JUNK = frozenset({"", "-", "0.0.0.0", "::", "0", "127.0.0.1", "::1", "localhost", "unknown", "n/a", "none", "null"})
|
||||
|
||||
ROW_BATCH = 1000 # rows fetched per DB query
|
||||
MAX_HOSTS = 1000 # hard cap on returned hosts
|
||||
|
||||
|
||||
def _clean(val: Any) -> str:
|
||||
"""Normalise a cell value to a clean string or empty."""
|
||||
s = (val if isinstance(val, str) else str(val) if val is not None else "").strip()
|
||||
return "" if s.lower() in _JUNK else s
|
||||
|
||||
|
||||
def _try_parse_ts(val: str) -> datetime | None:
|
||||
"""Best-effort timestamp parse (subset of common formats)."""
|
||||
for fmt in (
|
||||
"%Y-%m-%dT%H:%M:%S.%fZ",
|
||||
"%Y-%m-%dT%H:%M:%SZ",
|
||||
"%Y-%m-%dT%H:%M:%S.%f",
|
||||
"%Y-%m-%dT%H:%M:%S",
|
||||
"%Y-%m-%d %H:%M:%S.%f",
|
||||
"%Y-%m-%d %H:%M:%S",
|
||||
):
|
||||
try:
|
||||
return datetime.strptime(val.strip(), fmt)
|
||||
except ValueError:
|
||||
continue
|
||||
return None
|
||||
|
||||
|
||||
class _HostBucket:
|
||||
"""Mutable accumulator for a single host."""
|
||||
|
||||
__slots__ = (
|
||||
"hostname", "ips", "users", "os_versions", "mac_addresses",
|
||||
"protocols", "open_ports", "remote_targets", "datasets",
|
||||
"connection_count", "first_seen", "last_seen",
|
||||
)
|
||||
|
||||
def __init__(self, hostname: str):
|
||||
self.hostname = hostname
|
||||
self.ips: set[str] = set()
|
||||
self.users: set[str] = set()
|
||||
self.os_versions: set[str] = set()
|
||||
self.mac_addresses: set[str] = set()
|
||||
self.protocols: set[str] = set()
|
||||
self.open_ports: set[str] = set()
|
||||
self.remote_targets: set[str] = set()
|
||||
self.datasets: set[str] = set()
|
||||
self.connection_count: int = 0
|
||||
self.first_seen: datetime | None = None
|
||||
self.last_seen: datetime | None = None
|
||||
|
||||
def ingest(self, row: dict[str, Any], ds_name: str) -> None:
|
||||
"""Merge one normalised row into this bucket."""
|
||||
self.connection_count += 1
|
||||
self.datasets.add(ds_name)
|
||||
|
||||
for k in _IP_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
self.ips.add(v)
|
||||
|
||||
for k in _USER_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
self.users.add(v)
|
||||
|
||||
for k in _OS_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
self.os_versions.add(v)
|
||||
|
||||
for k in _MAC_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
self.mac_addresses.add(v)
|
||||
|
||||
for k in _PROTO_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
self.protocols.add(v.upper())
|
||||
|
||||
# Open ports = local (src) ports
|
||||
for k in _PORT_SRC_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v and v != "0":
|
||||
self.open_ports.add(v)
|
||||
|
||||
# Remote targets = dst IPs
|
||||
dst = _clean(row.get("dst_ip"))
|
||||
if dst:
|
||||
self.remote_targets.add(dst)
|
||||
|
||||
# Timestamps
|
||||
for k in _TS_KEYS:
|
||||
v = _clean(row.get(k))
|
||||
if v:
|
||||
ts = _try_parse_ts(v)
|
||||
if ts:
|
||||
if self.first_seen is None or ts < self.first_seen:
|
||||
self.first_seen = ts
|
||||
if self.last_seen is None or ts > self.last_seen:
|
||||
self.last_seen = ts
|
||||
|
||||
def to_dict(self) -> dict[str, Any]:
|
||||
return {
|
||||
"hostname": self.hostname,
|
||||
"ips": sorted(self.ips),
|
||||
"users": sorted(self.users),
|
||||
"os": sorted(self.os_versions),
|
||||
"mac_addresses": sorted(self.mac_addresses),
|
||||
"protocols": sorted(self.protocols),
|
||||
"open_ports": sorted(self.open_ports, key=lambda p: int(p) if p.isdigit() else 0),
|
||||
"remote_targets": sorted(self.remote_targets),
|
||||
"datasets": sorted(self.datasets),
|
||||
"connection_count": self.connection_count,
|
||||
"first_seen": self.first_seen.isoformat() if self.first_seen else None,
|
||||
"last_seen": self.last_seen.isoformat() if self.last_seen else None,
|
||||
}
|
||||
|
||||
|
||||
async def build_network_picture(
|
||||
db: AsyncSession,
|
||||
hunt_id: str,
|
||||
) -> dict[str, Any]:
|
||||
"""Build a deduplicated host inventory for all datasets in a hunt.
|
||||
|
||||
Returns:
|
||||
{
|
||||
"hosts": [ {hostname, ips[], users[], os[], ...}, ... ],
|
||||
"summary": { total_hosts, total_connections, total_unique_ips, datasets_scanned }
|
||||
}
|
||||
"""
|
||||
# 1. Get all datasets in this hunt
|
||||
ds_result = await db.execute(
|
||||
select(Dataset)
|
||||
.where(Dataset.hunt_id == hunt_id)
|
||||
.order_by(Dataset.created_at)
|
||||
)
|
||||
ds_list: Sequence[Dataset] = ds_result.scalars().all()
|
||||
|
||||
if not ds_list:
|
||||
return {
|
||||
"hosts": [],
|
||||
"summary": {
|
||||
"total_hosts": 0,
|
||||
"total_connections": 0,
|
||||
"total_unique_ips": 0,
|
||||
"datasets_scanned": 0,
|
||||
},
|
||||
}
|
||||
|
||||
# 2. Stream rows and aggregate into host buckets
|
||||
buckets: dict[str, _HostBucket] = {} # key = uppercase hostname or IP
|
||||
|
||||
for ds in ds_list:
|
||||
ds_name = ds.name or ds.filename
|
||||
offset = 0
|
||||
while True:
|
||||
stmt = (
|
||||
select(DatasetRow)
|
||||
.where(DatasetRow.dataset_id == ds.id)
|
||||
.order_by(DatasetRow.row_index)
|
||||
.limit(ROW_BATCH)
|
||||
.offset(offset)
|
||||
)
|
||||
result = await db.execute(stmt)
|
||||
rows: Sequence[DatasetRow] = result.scalars().all()
|
||||
if not rows:
|
||||
break
|
||||
|
||||
for dr in rows:
|
||||
norm = dr.normalized_data or dr.data or {}
|
||||
|
||||
# Determine grouping key: hostname preferred, else src_ip/ip_address
|
||||
host_val = ""
|
||||
for k in _HOST_KEYS:
|
||||
host_val = _clean(norm.get(k))
|
||||
if host_val:
|
||||
break
|
||||
if not host_val:
|
||||
for k in ("src_ip", "ip_address"):
|
||||
host_val = _clean(norm.get(k))
|
||||
if host_val:
|
||||
break
|
||||
if not host_val:
|
||||
# Row has no host identifier — skip
|
||||
continue
|
||||
|
||||
bucket_key = host_val.upper()
|
||||
if bucket_key not in buckets:
|
||||
buckets[bucket_key] = _HostBucket(host_val)
|
||||
|
||||
buckets[bucket_key].ingest(norm, ds_name)
|
||||
|
||||
offset += ROW_BATCH
|
||||
|
||||
# 3. Convert to sorted list (by connection count descending)
|
||||
hosts_raw = sorted(buckets.values(), key=lambda b: b.connection_count, reverse=True)
|
||||
if len(hosts_raw) > MAX_HOSTS:
|
||||
hosts_raw = hosts_raw[:MAX_HOSTS]
|
||||
|
||||
hosts = [b.to_dict() for b in hosts_raw]
|
||||
|
||||
# 4. Summary stats
|
||||
all_ips: set[str] = set()
|
||||
total_conns = 0
|
||||
for b in hosts_raw:
|
||||
all_ips.update(b.ips)
|
||||
total_conns += b.connection_count
|
||||
|
||||
return {
|
||||
"hosts": hosts,
|
||||
"summary": {
|
||||
"total_hosts": len(hosts),
|
||||
"total_connections": total_conns,
|
||||
"total_unique_ips": len(all_ips),
|
||||
"datasets_scanned": len(ds_list),
|
||||
},
|
||||
}
|
||||
@@ -23,12 +23,12 @@ COLUMN_MAPPINGS: list[tuple[str, str]] = [
|
||||
# Operating system
|
||||
(r"^(os|operating_?system|os_?version|os_?name|platform|os_?type)$", "os"),
|
||||
# Source / destination IPs
|
||||
(r"^(source_?ip|src_?ip|srcaddr|local_?address|sourceaddress)$", "src_ip"),
|
||||
(r"^(dest_?ip|dst_?ip|dstaddr|remote_?address|destinationaddress|destaddress)$", "dst_ip"),
|
||||
(r"^(source_?ip|src_?ip|srcaddr|local_?address|sourceaddress|sourceip|laddr\.?ip)$", "src_ip"),
|
||||
(r"^(dest_?ip|dst_?ip|dstaddr|remote_?address|destinationaddress|destaddress|destination_?ip|destinationip|raddr\.?ip)$", "dst_ip"),
|
||||
(r"^(ip_?address|ipaddress|ip)$", "ip_address"),
|
||||
# Ports
|
||||
(r"^(source_?port|src_?port|localport)$", "src_port"),
|
||||
(r"^(dest_?port|dst_?port|remoteport|destinationport)$", "dst_port"),
|
||||
(r"^(source_?port|src_?port|localport|laddr\.?port)$", "src_port"),
|
||||
(r"^(dest_?port|dst_?port|remoteport|destinationport|raddr\.?port)$", "dst_port"),
|
||||
# Process info
|
||||
(r"^(process_?name|name|image|exe|executable|binary)$", "process_name"),
|
||||
(r"^(pid|process_?id)$", "pid"),
|
||||
@@ -51,6 +51,10 @@ COLUMN_MAPPINGS: list[tuple[str, str]] = [
|
||||
(r"^(protocol|proto)$", "protocol"),
|
||||
(r"^(domain|dns_?name|query_?name|queriedname)$", "domain"),
|
||||
(r"^(url|uri|request_?url)$", "url"),
|
||||
# MAC address
|
||||
(r"^(mac|mac_?address|physical_?address|mac_?addr|hw_?addr|ethernet)$", "mac_address"),
|
||||
# Connection state (netstat)
|
||||
(r"^(state|status|tcp_?state|conn_?state)$", "connection_state"),
|
||||
# Event info
|
||||
(r"^(event_?id|eventid|eid)$", "event_id"),
|
||||
(r"^(event_?type|eventtype|category|action)$", "event_type"),
|
||||
@@ -120,13 +124,27 @@ def detect_ioc_columns(
|
||||
"domain": "domain",
|
||||
}
|
||||
|
||||
# Canonical names that should NEVER be treated as IOCs even if values
|
||||
# match a pattern (e.g. process_name "svchost.exe" matching domain regex).
|
||||
_non_ioc_canonicals = frozenset({
|
||||
"process_name", "file_name", "file_path", "command_line",
|
||||
"parent_command_line", "description", "event_type", "registry_key",
|
||||
"registry_value", "severity", "os",
|
||||
"title", "netmask", "gateway", "connection_state",
|
||||
})
|
||||
|
||||
for col in columns:
|
||||
canonical = column_mapping.get(col, "")
|
||||
|
||||
# Skip columns whose canonical meaning is obviously not an IOC
|
||||
if canonical in _non_ioc_canonicals:
|
||||
continue
|
||||
|
||||
col_type = column_types.get(col)
|
||||
if col_type in ioc_type_map:
|
||||
ioc_columns[col] = ioc_type_map[col_type]
|
||||
|
||||
# Also check canonical name
|
||||
canonical = column_mapping.get(col, "")
|
||||
if canonical in ("src_ip", "dst_ip", "ip_address"):
|
||||
ioc_columns[col] = "ip"
|
||||
elif canonical == "hash_md5":
|
||||
@@ -139,6 +157,8 @@ def detect_ioc_columns(
|
||||
ioc_columns[col] = "domain"
|
||||
elif canonical == "url":
|
||||
ioc_columns[col] = "url"
|
||||
elif canonical == "hostname":
|
||||
ioc_columns[col] = "hostname"
|
||||
|
||||
return ioc_columns
|
||||
|
||||
|
||||
269
backend/app/services/playbook.py
Normal file
269
backend/app/services/playbook.py
Normal file
@@ -0,0 +1,269 @@
|
||||
"""Investigation Notebook & Playbook Engine for ThreatHunt.
|
||||
|
||||
Notebooks: Analyst-facing, cell-based documents (markdown + code cells)
|
||||
stored as JSON in the database. Each cell can contain free-form
|
||||
markdown notes *or* a structured query/command that the backend
|
||||
evaluates against datasets.
|
||||
|
||||
Playbooks: Pre-defined, step-by-step investigation workflows. Each step
|
||||
defines an action (query, analyze, enrich, tag) and expected
|
||||
outcomes. Analysts can run through playbooks interactively or
|
||||
trigger them automatically on new alerts.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import logging
|
||||
import re
|
||||
from dataclasses import dataclass, field
|
||||
from datetime import datetime, timezone
|
||||
from typing import Any, Optional
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ── Notebook helpers ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
@dataclass
|
||||
class NotebookCell:
|
||||
id: str
|
||||
cell_type: str # markdown | query | code
|
||||
source: str
|
||||
output: Optional[str] = None
|
||||
metadata: dict = field(default_factory=dict)
|
||||
|
||||
|
||||
def validate_notebook_cells(cells: list[dict]) -> list[dict]:
|
||||
"""Ensure each cell has required keys."""
|
||||
cleaned: list[dict] = []
|
||||
for i, c in enumerate(cells):
|
||||
cleaned.append({
|
||||
"id": c.get("id", f"cell-{i}"),
|
||||
"cell_type": c.get("cell_type", "markdown"),
|
||||
"source": c.get("source", ""),
|
||||
"output": c.get("output"),
|
||||
"metadata": c.get("metadata", {}),
|
||||
})
|
||||
return cleaned
|
||||
|
||||
|
||||
# ── Built-in Playbook Templates ──────────────────────────────────────
|
||||
|
||||
|
||||
BUILT_IN_PLAYBOOKS: list[dict[str, Any]] = [
|
||||
{
|
||||
"name": "Suspicious Process Investigation",
|
||||
"description": "Step-by-step investigation of a potentially malicious process execution.",
|
||||
"category": "incident_response",
|
||||
"tags": ["process", "malware", "T1059"],
|
||||
"steps": [
|
||||
{
|
||||
"order": 1,
|
||||
"title": "Identify the suspicious process",
|
||||
"description": "Search for the process name/PID across all datasets. Note the command line, parent, and user context.",
|
||||
"action": "search",
|
||||
"action_config": {"fields": ["process_name", "command_line", "parent_process_name", "username"]},
|
||||
"expected_outcome": "Process details, parent chain, and execution context identified.",
|
||||
},
|
||||
{
|
||||
"order": 2,
|
||||
"title": "Build process tree",
|
||||
"description": "View the full parent→child process tree to understand the execution chain.",
|
||||
"action": "process_tree",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Complete process lineage showing how the suspicious process was spawned.",
|
||||
},
|
||||
{
|
||||
"order": 3,
|
||||
"title": "Check network connections",
|
||||
"description": "Search for network events associated with the same host and timeframe.",
|
||||
"action": "search",
|
||||
"action_config": {"fields": ["src_ip", "dst_ip", "dst_port", "protocol"]},
|
||||
"expected_outcome": "Network connections revealing potential C2 or data exfiltration.",
|
||||
},
|
||||
{
|
||||
"order": 4,
|
||||
"title": "Run analyzers",
|
||||
"description": "Execute the suspicious_commands and entropy analyzers against the dataset.",
|
||||
"action": "analyze",
|
||||
"action_config": {"analyzers": ["suspicious_commands", "entropy"]},
|
||||
"expected_outcome": "Automated detection of known-bad patterns.",
|
||||
},
|
||||
{
|
||||
"order": 5,
|
||||
"title": "Map to MITRE ATT&CK",
|
||||
"description": "Check which MITRE techniques the process behavior maps to.",
|
||||
"action": "mitre_map",
|
||||
"action_config": {},
|
||||
"expected_outcome": "MITRE technique mappings for the suspicious activity.",
|
||||
},
|
||||
{
|
||||
"order": 6,
|
||||
"title": "Document findings & create case",
|
||||
"description": "Summarize investigation findings, annotate key evidence, and create a case if warranted.",
|
||||
"action": "create_case",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Investigation documented with annotations and optionally escalated.",
|
||||
},
|
||||
],
|
||||
},
|
||||
{
|
||||
"name": "Lateral Movement Hunt",
|
||||
"description": "Systematic hunt for lateral movement indicators across the environment.",
|
||||
"category": "threat_hunting",
|
||||
"tags": ["lateral_movement", "T1021", "T1047"],
|
||||
"steps": [
|
||||
{
|
||||
"order": 1,
|
||||
"title": "Search for remote access tools",
|
||||
"description": "Look for PsExec, WMI, WinRM, RDP, and SSH usage across datasets.",
|
||||
"action": "search",
|
||||
"action_config": {"query": "psexec|wmic|winrm|rdp|ssh"},
|
||||
"expected_outcome": "Identify all remote access tool usage.",
|
||||
},
|
||||
{
|
||||
"order": 2,
|
||||
"title": "Analyze authentication events",
|
||||
"description": "Run the auth anomaly analyzer to find brute force, unusual logon types.",
|
||||
"action": "analyze",
|
||||
"action_config": {"analyzers": ["auth_anomaly"]},
|
||||
"expected_outcome": "Authentication anomalies detected.",
|
||||
},
|
||||
{
|
||||
"order": 3,
|
||||
"title": "Check network anomalies",
|
||||
"description": "Run network anomaly analyzer for beaconing and suspicious connections.",
|
||||
"action": "analyze",
|
||||
"action_config": {"analyzers": ["network_anomaly"]},
|
||||
"expected_outcome": "Beaconing or unusual network patterns identified.",
|
||||
},
|
||||
{
|
||||
"order": 4,
|
||||
"title": "Build knowledge graph",
|
||||
"description": "Visualize entity relationships to identify pivot paths.",
|
||||
"action": "knowledge_graph",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Entity relationship graph showing lateral movement paths.",
|
||||
},
|
||||
{
|
||||
"order": 5,
|
||||
"title": "Document and escalate",
|
||||
"description": "Create annotations for key findings and escalate to case if needed.",
|
||||
"action": "create_case",
|
||||
"action_config": {"tags": ["lateral_movement"]},
|
||||
"expected_outcome": "Findings documented and case created.",
|
||||
},
|
||||
],
|
||||
},
|
||||
{
|
||||
"name": "Data Exfiltration Check",
|
||||
"description": "Investigate potential data exfiltration activity.",
|
||||
"category": "incident_response",
|
||||
"tags": ["exfiltration", "T1048", "T1567"],
|
||||
"steps": [
|
||||
{
|
||||
"order": 1,
|
||||
"title": "Identify large transfers",
|
||||
"description": "Search for network events with unusually high byte counts.",
|
||||
"action": "analyze",
|
||||
"action_config": {"analyzers": ["network_anomaly"], "config": {"large_transfer_threshold": 5000000}},
|
||||
"expected_outcome": "Large data transfers identified.",
|
||||
},
|
||||
{
|
||||
"order": 2,
|
||||
"title": "Check DNS anomalies",
|
||||
"description": "Look for DNS tunneling or unusual DNS query patterns.",
|
||||
"action": "search",
|
||||
"action_config": {"fields": ["dns_query", "query_length"]},
|
||||
"expected_outcome": "Suspicious DNS activity identified.",
|
||||
},
|
||||
{
|
||||
"order": 3,
|
||||
"title": "Timeline analysis",
|
||||
"description": "Examine the timeline for data staging and exfiltration windows.",
|
||||
"action": "timeline",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Time windows of suspicious activity identified.",
|
||||
},
|
||||
{
|
||||
"order": 4,
|
||||
"title": "Correlate with process activity",
|
||||
"description": "Match network exfiltration with process execution times.",
|
||||
"action": "search",
|
||||
"action_config": {"fields": ["process_name", "dst_ip", "bytes_sent"]},
|
||||
"expected_outcome": "Process responsible for data transfer identified.",
|
||||
},
|
||||
{
|
||||
"order": 5,
|
||||
"title": "MITRE mapping & documentation",
|
||||
"description": "Map findings to MITRE exfiltration techniques and document.",
|
||||
"action": "mitre_map",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Complete exfiltration investigation documented.",
|
||||
},
|
||||
],
|
||||
},
|
||||
{
|
||||
"name": "Ransomware Triage",
|
||||
"description": "Rapid triage of potential ransomware activity.",
|
||||
"category": "incident_response",
|
||||
"tags": ["ransomware", "T1486", "T1490"],
|
||||
"steps": [
|
||||
{
|
||||
"order": 1,
|
||||
"title": "Search for ransomware indicators",
|
||||
"description": "Look for shadow copy deletion, boot config changes, encryption activity.",
|
||||
"action": "search",
|
||||
"action_config": {"query": "vssadmin|bcdedit|cipher|.encrypted|.locked|ransom"},
|
||||
"expected_outcome": "Ransomware indicators identified.",
|
||||
},
|
||||
{
|
||||
"order": 2,
|
||||
"title": "Run all analyzers",
|
||||
"description": "Execute all analyzers to get comprehensive threat picture.",
|
||||
"action": "analyze",
|
||||
"action_config": {},
|
||||
"expected_outcome": "Full automated analysis of ransomware indicators.",
|
||||
},
|
||||
{
|
||||
"order": 3,
|
||||
"title": "Check persistence mechanisms",
|
||||
"description": "Look for persistence that may indicate pre-ransomware staging.",
|
||||
"action": "analyze",
|
||||
"action_config": {"analyzers": ["persistence"]},
|
||||
"expected_outcome": "Persistence mechanisms identified.",
|
||||
},
|
||||
{
|
||||
"order": 4,
|
||||
"title": "LLM deep analysis",
|
||||
"description": "Run deep LLM analysis for comprehensive ransomware assessment.",
|
||||
"action": "llm_analyze",
|
||||
"action_config": {"mode": "deep", "focus": "ransomware"},
|
||||
"expected_outcome": "AI-powered ransomware analysis with recommendations.",
|
||||
},
|
||||
{
|
||||
"order": 5,
|
||||
"title": "Create critical case",
|
||||
"description": "Immediately create a critical-severity case for the ransomware incident.",
|
||||
"action": "create_case",
|
||||
"action_config": {"severity": "critical", "tags": ["ransomware"]},
|
||||
"expected_outcome": "Critical case created for incident response.",
|
||||
},
|
||||
],
|
||||
},
|
||||
]
|
||||
|
||||
|
||||
def get_builtin_playbooks() -> list[dict]:
|
||||
"""Return list of all built-in playbook templates."""
|
||||
return BUILT_IN_PLAYBOOKS
|
||||
|
||||
|
||||
def get_playbook_template(name: str) -> dict | None:
|
||||
"""Get a specific built-in playbook by name."""
|
||||
for pb in BUILT_IN_PLAYBOOKS:
|
||||
if pb["name"] == name:
|
||||
return pb
|
||||
return None
|
||||
447
backend/app/services/process_tree.py
Normal file
447
backend/app/services/process_tree.py
Normal file
@@ -0,0 +1,447 @@
|
||||
"""Process tree and storyline graph builder.
|
||||
|
||||
Extracts parent→child process relationships from dataset rows and builds
|
||||
hierarchical trees. Also builds attack-storyline graphs connecting events
|
||||
by host → process → network activity → file activity chains.
|
||||
"""
|
||||
|
||||
import logging
|
||||
from collections import defaultdict
|
||||
from typing import Any, Sequence
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
from sqlalchemy.orm import selectinload
|
||||
|
||||
from app.db.models import Dataset, DatasetRow
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
# ── Helpers ───────────────────────────────────────────────────────────
|
||||
|
||||
_JUNK = frozenset({"", "N/A", "n/a", "-", "—", "null", "None", "none", "unknown"})
|
||||
|
||||
|
||||
def _clean(val: Any) -> str | None:
|
||||
"""Return cleaned string or None for junk values."""
|
||||
if val is None:
|
||||
return None
|
||||
s = str(val).strip()
|
||||
return None if s in _JUNK else s
|
||||
|
||||
|
||||
# ── Process Tree ──────────────────────────────────────────────────────
|
||||
|
||||
|
||||
class ProcessNode:
|
||||
"""A single process in the tree."""
|
||||
|
||||
__slots__ = (
|
||||
"pid", "ppid", "name", "command_line", "username", "hostname",
|
||||
"timestamp", "dataset_name", "row_index", "children", "extra",
|
||||
)
|
||||
|
||||
def __init__(self, **kw: Any):
|
||||
self.pid: str = kw.get("pid", "")
|
||||
self.ppid: str = kw.get("ppid", "")
|
||||
self.name: str = kw.get("name", "")
|
||||
self.command_line: str = kw.get("command_line", "")
|
||||
self.username: str = kw.get("username", "")
|
||||
self.hostname: str = kw.get("hostname", "")
|
||||
self.timestamp: str = kw.get("timestamp", "")
|
||||
self.dataset_name: str = kw.get("dataset_name", "")
|
||||
self.row_index: int = kw.get("row_index", -1)
|
||||
self.children: list["ProcessNode"] = []
|
||||
self.extra: dict = kw.get("extra", {})
|
||||
|
||||
def to_dict(self) -> dict:
|
||||
return {
|
||||
"pid": self.pid,
|
||||
"ppid": self.ppid,
|
||||
"name": self.name,
|
||||
"command_line": self.command_line,
|
||||
"username": self.username,
|
||||
"hostname": self.hostname,
|
||||
"timestamp": self.timestamp,
|
||||
"dataset_name": self.dataset_name,
|
||||
"row_index": self.row_index,
|
||||
"children": [c.to_dict() for c in self.children],
|
||||
"extra": self.extra,
|
||||
}
|
||||
|
||||
|
||||
async def build_process_tree(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
hostname_filter: str | None = None,
|
||||
) -> list[dict]:
|
||||
"""Build process trees from dataset rows.
|
||||
|
||||
Returns a list of root-level process nodes (forest).
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
if not rows:
|
||||
return []
|
||||
|
||||
# Group processes by (hostname, pid) → node
|
||||
nodes_by_key: dict[tuple[str, str], ProcessNode] = {}
|
||||
nodes_list: list[ProcessNode] = []
|
||||
|
||||
for row_obj in rows:
|
||||
data = row_obj.normalized_data or row_obj.data
|
||||
pid = _clean(data.get("pid"))
|
||||
if not pid:
|
||||
continue
|
||||
|
||||
ppid = _clean(data.get("ppid")) or ""
|
||||
hostname = _clean(data.get("hostname")) or "unknown"
|
||||
|
||||
if hostname_filter and hostname.lower() != hostname_filter.lower():
|
||||
continue
|
||||
|
||||
node = ProcessNode(
|
||||
pid=pid,
|
||||
ppid=ppid,
|
||||
name=_clean(data.get("process_name")) or _clean(data.get("name")) or "",
|
||||
command_line=_clean(data.get("command_line")) or "",
|
||||
username=_clean(data.get("username")) or "",
|
||||
hostname=hostname,
|
||||
timestamp=_clean(data.get("timestamp")) or "",
|
||||
dataset_name=row_obj.dataset.name if row_obj.dataset else "",
|
||||
row_index=row_obj.row_index,
|
||||
extra={
|
||||
k: str(v)
|
||||
for k, v in data.items()
|
||||
if k not in {"pid", "ppid", "process_name", "name", "command_line",
|
||||
"username", "hostname", "timestamp"}
|
||||
and v is not None and str(v).strip() not in _JUNK
|
||||
},
|
||||
)
|
||||
|
||||
key = (hostname, pid)
|
||||
# Keep the first occurrence (earlier in data) or overwrite if deeper info
|
||||
if key not in nodes_by_key:
|
||||
nodes_by_key[key] = node
|
||||
nodes_list.append(node)
|
||||
|
||||
# Link parent → child
|
||||
roots: list[ProcessNode] = []
|
||||
for node in nodes_list:
|
||||
parent_key = (node.hostname, node.ppid)
|
||||
parent = nodes_by_key.get(parent_key)
|
||||
if parent and parent is not node:
|
||||
parent.children.append(node)
|
||||
else:
|
||||
roots.append(node)
|
||||
|
||||
return [r.to_dict() for r in roots]
|
||||
|
||||
|
||||
# ── Storyline / Attack Graph ─────────────────────────────────────────
|
||||
|
||||
|
||||
async def build_storyline(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
hostname_filter: str | None = None,
|
||||
) -> dict:
|
||||
"""Build a CrowdStrike-style storyline graph.
|
||||
|
||||
Nodes represent events (process start, network connection, file write, etc.)
|
||||
Edges represent causal / temporal relationships.
|
||||
|
||||
Returns a Cytoscape-compatible elements dict {nodes: [...], edges: [...]}.
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
if not rows:
|
||||
return {"nodes": [], "edges": [], "summary": {}}
|
||||
|
||||
nodes: list[dict] = []
|
||||
edges: list[dict] = []
|
||||
seen_ids: set[str] = set()
|
||||
host_events: dict[str, list[dict]] = defaultdict(list)
|
||||
|
||||
for row_obj in rows:
|
||||
data = row_obj.normalized_data or row_obj.data
|
||||
hostname = _clean(data.get("hostname")) or "unknown"
|
||||
|
||||
if hostname_filter and hostname.lower() != hostname_filter.lower():
|
||||
continue
|
||||
|
||||
event_type = _classify_event(data)
|
||||
node_id = f"{row_obj.dataset_id}_{row_obj.row_index}"
|
||||
if node_id in seen_ids:
|
||||
continue
|
||||
seen_ids.add(node_id)
|
||||
|
||||
label = _build_label(data, event_type)
|
||||
severity = _estimate_severity(data, event_type)
|
||||
|
||||
node = {
|
||||
"data": {
|
||||
"id": node_id,
|
||||
"label": label,
|
||||
"event_type": event_type,
|
||||
"hostname": hostname,
|
||||
"timestamp": _clean(data.get("timestamp")) or "",
|
||||
"pid": _clean(data.get("pid")) or "",
|
||||
"ppid": _clean(data.get("ppid")) or "",
|
||||
"process_name": _clean(data.get("process_name")) or "",
|
||||
"command_line": _clean(data.get("command_line")) or "",
|
||||
"username": _clean(data.get("username")) or "",
|
||||
"src_ip": _clean(data.get("src_ip")) or "",
|
||||
"dst_ip": _clean(data.get("dst_ip")) or "",
|
||||
"dst_port": _clean(data.get("dst_port")) or "",
|
||||
"file_path": _clean(data.get("file_path")) or "",
|
||||
"severity": severity,
|
||||
"dataset_id": row_obj.dataset_id,
|
||||
"row_index": row_obj.row_index,
|
||||
},
|
||||
}
|
||||
nodes.append(node)
|
||||
host_events[hostname].append(node["data"])
|
||||
|
||||
# Build edges: parent→child (by pid/ppid) and temporal sequence per host
|
||||
pid_lookup: dict[tuple[str, str], str] = {} # (host, pid) → node_id
|
||||
for node in nodes:
|
||||
d = node["data"]
|
||||
if d["pid"]:
|
||||
pid_lookup[(d["hostname"], d["pid"])] = d["id"]
|
||||
|
||||
for node in nodes:
|
||||
d = node["data"]
|
||||
if d["ppid"]:
|
||||
parent_id = pid_lookup.get((d["hostname"], d["ppid"]))
|
||||
if parent_id and parent_id != d["id"]:
|
||||
edges.append({
|
||||
"data": {
|
||||
"id": f"e_{parent_id}_{d['id']}",
|
||||
"source": parent_id,
|
||||
"target": d["id"],
|
||||
"relationship": "spawned",
|
||||
}
|
||||
})
|
||||
|
||||
# Temporal edges within each host (sorted by timestamp)
|
||||
for hostname, events in host_events.items():
|
||||
sorted_events = sorted(events, key=lambda e: e.get("timestamp", ""))
|
||||
for i in range(len(sorted_events) - 1):
|
||||
src = sorted_events[i]
|
||||
tgt = sorted_events[i + 1]
|
||||
edge_id = f"t_{src['id']}_{tgt['id']}"
|
||||
# Avoid duplicate edges
|
||||
if not any(e["data"]["id"] == edge_id for e in edges):
|
||||
edges.append({
|
||||
"data": {
|
||||
"id": edge_id,
|
||||
"source": src["id"],
|
||||
"target": tgt["id"],
|
||||
"relationship": "temporal",
|
||||
}
|
||||
})
|
||||
|
||||
# Summary stats
|
||||
type_counts: dict[str, int] = defaultdict(int)
|
||||
for n in nodes:
|
||||
type_counts[n["data"]["event_type"]] += 1
|
||||
|
||||
summary = {
|
||||
"total_events": len(nodes),
|
||||
"total_edges": len(edges),
|
||||
"hosts": list(host_events.keys()),
|
||||
"event_types": dict(type_counts),
|
||||
}
|
||||
|
||||
return {"nodes": nodes, "edges": edges, "summary": summary}
|
||||
|
||||
|
||||
# ── Risk scoring for dashboard ────────────────────────────────────────
|
||||
|
||||
async def compute_risk_scores(
|
||||
db: AsyncSession,
|
||||
hunt_id: str | None = None,
|
||||
) -> dict:
|
||||
"""Compute per-host risk scores from anomaly signals in datasets.
|
||||
|
||||
Returns {hosts: [{hostname, score, signals, ...}], overall_score, ...}
|
||||
"""
|
||||
rows = await _fetch_rows(db, hunt_id=hunt_id)
|
||||
if not rows:
|
||||
return {"hosts": [], "overall_score": 0, "total_events": 0,
|
||||
"severity_breakdown": {}}
|
||||
|
||||
host_signals: dict[str, dict] = defaultdict(
|
||||
lambda: {"hostname": "", "score": 0, "signals": [],
|
||||
"event_count": 0, "process_count": 0,
|
||||
"network_count": 0, "file_count": 0}
|
||||
)
|
||||
|
||||
severity_counts = {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}
|
||||
|
||||
for row_obj in rows:
|
||||
data = row_obj.normalized_data or row_obj.data
|
||||
hostname = _clean(data.get("hostname")) or "unknown"
|
||||
entry = host_signals[hostname]
|
||||
entry["hostname"] = hostname
|
||||
entry["event_count"] += 1
|
||||
|
||||
event_type = _classify_event(data)
|
||||
severity = _estimate_severity(data, event_type)
|
||||
severity_counts[severity] = severity_counts.get(severity, 0) + 1
|
||||
|
||||
# Count event types
|
||||
if event_type == "process":
|
||||
entry["process_count"] += 1
|
||||
elif event_type == "network":
|
||||
entry["network_count"] += 1
|
||||
elif event_type == "file":
|
||||
entry["file_count"] += 1
|
||||
|
||||
# Risk signals
|
||||
cmd = (_clean(data.get("command_line")) or "").lower()
|
||||
proc = (_clean(data.get("process_name")) or "").lower()
|
||||
|
||||
# Detect suspicious patterns
|
||||
sus_patterns = [
|
||||
("powershell -enc", 8, "Encoded PowerShell"),
|
||||
("invoke-expression", 7, "PowerShell IEX"),
|
||||
("invoke-webrequest", 6, "PowerShell WebRequest"),
|
||||
("certutil -urlcache", 8, "Certutil download"),
|
||||
("bitsadmin /transfer", 7, "BITS transfer"),
|
||||
("regsvr32 /s /n /u", 8, "Regsvr32 squiblydoo"),
|
||||
("mshta ", 7, "MSHTA execution"),
|
||||
("wmic process", 6, "WMIC process enum"),
|
||||
("net user", 5, "User enumeration"),
|
||||
("whoami", 4, "Whoami recon"),
|
||||
("mimikatz", 10, "Mimikatz detected"),
|
||||
("procdump", 7, "Process dumping"),
|
||||
("psexec", 7, "PsExec lateral movement"),
|
||||
]
|
||||
|
||||
for pattern, score_add, signal_name in sus_patterns:
|
||||
if pattern in cmd or pattern in proc:
|
||||
entry["score"] += score_add
|
||||
if signal_name not in entry["signals"]:
|
||||
entry["signals"].append(signal_name)
|
||||
|
||||
# External connections score
|
||||
dst_ip = _clean(data.get("dst_ip")) or ""
|
||||
if dst_ip and not dst_ip.startswith(("10.", "192.168.", "172.")):
|
||||
entry["score"] += 1
|
||||
if "External connections" not in entry["signals"]:
|
||||
entry["signals"].append("External connections")
|
||||
|
||||
# Normalize scores (0-100)
|
||||
max_score = max((h["score"] for h in host_signals.values()), default=1)
|
||||
if max_score > 0:
|
||||
for entry in host_signals.values():
|
||||
entry["score"] = min(round((entry["score"] / max_score) * 100), 100)
|
||||
|
||||
hosts = sorted(host_signals.values(), key=lambda h: h["score"], reverse=True)
|
||||
overall = round(sum(h["score"] for h in hosts) / max(len(hosts), 1))
|
||||
|
||||
return {
|
||||
"hosts": hosts,
|
||||
"overall_score": overall,
|
||||
"total_events": sum(h["event_count"] for h in hosts),
|
||||
"severity_breakdown": severity_counts,
|
||||
}
|
||||
|
||||
|
||||
# ── Internal helpers ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
async def _fetch_rows(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
limit: int = 50_000,
|
||||
) -> Sequence[DatasetRow]:
|
||||
"""Fetch dataset rows, optionally filtered by dataset or hunt."""
|
||||
stmt = (
|
||||
select(DatasetRow)
|
||||
.join(Dataset)
|
||||
.options(selectinload(DatasetRow.dataset))
|
||||
)
|
||||
|
||||
if dataset_id:
|
||||
stmt = stmt.where(DatasetRow.dataset_id == dataset_id)
|
||||
elif hunt_id:
|
||||
stmt = stmt.where(Dataset.hunt_id == hunt_id)
|
||||
else:
|
||||
# No filter — limit to prevent OOM
|
||||
pass
|
||||
|
||||
stmt = stmt.order_by(DatasetRow.row_index).limit(limit)
|
||||
result = await db.execute(stmt)
|
||||
return result.scalars().all()
|
||||
|
||||
|
||||
def _classify_event(data: dict) -> str:
|
||||
"""Classify a row as process / network / file / registry / other."""
|
||||
if _clean(data.get("pid")) or _clean(data.get("process_name")):
|
||||
if _clean(data.get("dst_ip")) or _clean(data.get("dst_port")):
|
||||
return "network"
|
||||
if _clean(data.get("file_path")):
|
||||
return "file"
|
||||
return "process"
|
||||
if _clean(data.get("dst_ip")) or _clean(data.get("src_ip")):
|
||||
return "network"
|
||||
if _clean(data.get("file_path")):
|
||||
return "file"
|
||||
if _clean(data.get("registry_key")):
|
||||
return "registry"
|
||||
return "other"
|
||||
|
||||
|
||||
def _build_label(data: dict, event_type: str) -> str:
|
||||
"""Build a concise node label for storyline display."""
|
||||
name = _clean(data.get("process_name")) or ""
|
||||
pid = _clean(data.get("pid")) or ""
|
||||
dst = _clean(data.get("dst_ip")) or ""
|
||||
port = _clean(data.get("dst_port")) or ""
|
||||
fpath = _clean(data.get("file_path")) or ""
|
||||
|
||||
if event_type == "process":
|
||||
return f"{name} (PID {pid})" if pid else name or "process"
|
||||
elif event_type == "network":
|
||||
target = f"{dst}:{port}" if dst and port else dst or port
|
||||
return f"{name} → {target}" if name else target or "network"
|
||||
elif event_type == "file":
|
||||
fname = fpath.split("\\")[-1].split("/")[-1] if fpath else ""
|
||||
return f"{name} → {fname}" if name else fname or "file"
|
||||
elif event_type == "registry":
|
||||
return _clean(data.get("registry_key")) or "registry"
|
||||
return name or "event"
|
||||
|
||||
|
||||
def _estimate_severity(data: dict, event_type: str) -> str:
|
||||
"""Rough heuristic severity estimate."""
|
||||
cmd = (_clean(data.get("command_line")) or "").lower()
|
||||
proc = (_clean(data.get("process_name")) or "").lower()
|
||||
|
||||
# Critical indicators
|
||||
critical_kw = ["mimikatz", "cobalt", "meterpreter", "empire", "bloodhound"]
|
||||
if any(k in cmd or k in proc for k in critical_kw):
|
||||
return "critical"
|
||||
|
||||
# High indicators
|
||||
high_kw = ["powershell -enc", "certutil -urlcache", "regsvr32", "mshta",
|
||||
"bitsadmin", "psexec", "procdump"]
|
||||
if any(k in cmd for k in high_kw):
|
||||
return "high"
|
||||
|
||||
# Medium indicators
|
||||
medium_kw = ["invoke-", "wmic", "net user", "net group", "schtasks",
|
||||
"reg add", "sc create"]
|
||||
if any(k in cmd for k in medium_kw):
|
||||
return "medium"
|
||||
|
||||
# Low: recon
|
||||
low_kw = ["whoami", "ipconfig", "systeminfo", "tasklist", "netstat"]
|
||||
if any(k in cmd for k in low_kw):
|
||||
return "low"
|
||||
|
||||
return "info"
|
||||
254
backend/app/services/timeline.py
Normal file
254
backend/app/services/timeline.py
Normal file
@@ -0,0 +1,254 @@
|
||||
"""Timeline and field-statistics service.
|
||||
|
||||
Provides temporal histogram bins and per-field distribution stats
|
||||
for dataset rows — used by the TimelineScrubber and QueryBar components.
|
||||
"""
|
||||
|
||||
import logging
|
||||
from collections import Counter, defaultdict
|
||||
from datetime import datetime
|
||||
from typing import Any, Sequence
|
||||
|
||||
from sqlalchemy import select
|
||||
from sqlalchemy.ext.asyncio import AsyncSession
|
||||
|
||||
from app.db.models import Dataset, DatasetRow
|
||||
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
|
||||
# ── Timeline bins ─────────────────────────────────────────────────────
|
||||
|
||||
|
||||
async def build_timeline_bins(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
bins: int = 60,
|
||||
) -> dict:
|
||||
"""Create histogram bins of events over time.
|
||||
|
||||
Returns {bins: [{start, end, count, events_by_type}], total, range}.
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
if not rows:
|
||||
return {"bins": [], "total": 0, "range": None}
|
||||
|
||||
# Extract timestamps
|
||||
events: list[dict] = []
|
||||
for r in rows:
|
||||
data = r.normalized_data or r.data
|
||||
ts_str = data.get("timestamp", "")
|
||||
if not ts_str:
|
||||
continue
|
||||
ts = _parse_ts(str(ts_str))
|
||||
if ts:
|
||||
events.append({
|
||||
"timestamp": ts,
|
||||
"event_type": _classify_type(data),
|
||||
"hostname": data.get("hostname", ""),
|
||||
})
|
||||
|
||||
if not events:
|
||||
return {"bins": [], "total": len(rows), "range": None}
|
||||
|
||||
events.sort(key=lambda e: e["timestamp"])
|
||||
ts_min = events[0]["timestamp"]
|
||||
ts_max = events[-1]["timestamp"]
|
||||
|
||||
if ts_min == ts_max:
|
||||
return {
|
||||
"bins": [{"start": ts_min.isoformat(), "end": ts_max.isoformat(),
|
||||
"count": len(events), "events_by_type": {}}],
|
||||
"total": len(events),
|
||||
"range": {"start": ts_min.isoformat(), "end": ts_max.isoformat()},
|
||||
}
|
||||
|
||||
delta = (ts_max - ts_min) / bins
|
||||
result_bins: list[dict] = []
|
||||
|
||||
for i in range(bins):
|
||||
bin_start = ts_min + delta * i
|
||||
bin_end = ts_min + delta * (i + 1)
|
||||
bin_events = [e for e in events
|
||||
if bin_start <= e["timestamp"] < bin_end
|
||||
or (i == bins - 1 and e["timestamp"] == ts_max)]
|
||||
type_counts: dict[str, int] = Counter(e["event_type"] for e in bin_events)
|
||||
result_bins.append({
|
||||
"start": bin_start.isoformat(),
|
||||
"end": bin_end.isoformat(),
|
||||
"count": len(bin_events),
|
||||
"events_by_type": dict(type_counts),
|
||||
})
|
||||
|
||||
return {
|
||||
"bins": result_bins,
|
||||
"total": len(events),
|
||||
"range": {"start": ts_min.isoformat(), "end": ts_max.isoformat()},
|
||||
}
|
||||
|
||||
|
||||
# ── Field stats ───────────────────────────────────────────────────────
|
||||
|
||||
|
||||
async def compute_field_stats(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
fields: list[str] | None = None,
|
||||
top_n: int = 20,
|
||||
) -> dict:
|
||||
"""Compute per-field value distributions.
|
||||
|
||||
Returns {fields: {field_name: {total, unique, top: [{value, count}]}}}
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id=dataset_id, hunt_id=hunt_id)
|
||||
if not rows:
|
||||
return {"fields": {}, "total_rows": 0}
|
||||
|
||||
# Determine which fields to analyze
|
||||
sample_data = rows[0].normalized_data or rows[0].data
|
||||
all_fields = list(sample_data.keys())
|
||||
target_fields = fields if fields else all_fields[:30]
|
||||
|
||||
stats: dict[str, dict] = {}
|
||||
for field in target_fields:
|
||||
values = []
|
||||
for r in rows:
|
||||
data = r.normalized_data or r.data
|
||||
v = data.get(field)
|
||||
if v is not None and str(v).strip() not in ("", "N/A", "n/a", "-", "None"):
|
||||
values.append(str(v))
|
||||
|
||||
counter = Counter(values)
|
||||
top = [{"value": v, "count": c} for v, c in counter.most_common(top_n)]
|
||||
stats[field] = {
|
||||
"total": len(values),
|
||||
"unique": len(counter),
|
||||
"top": top,
|
||||
}
|
||||
|
||||
return {
|
||||
"fields": stats,
|
||||
"total_rows": len(rows),
|
||||
"available_fields": all_fields,
|
||||
}
|
||||
|
||||
|
||||
# ── Row search with filters ──────────────────────────────────────────
|
||||
|
||||
|
||||
async def search_rows(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
query: str = "",
|
||||
filters: dict[str, str] | None = None,
|
||||
time_start: str | None = None,
|
||||
time_end: str | None = None,
|
||||
limit: int = 500,
|
||||
offset: int = 0,
|
||||
) -> dict:
|
||||
"""Search/filter dataset rows.
|
||||
|
||||
Supports:
|
||||
- Free-text search across all fields
|
||||
- Field-specific filters {field: value}
|
||||
- Time range filters
|
||||
"""
|
||||
rows = await _fetch_rows(db, dataset_id=dataset_id, hunt_id=hunt_id, limit=50000)
|
||||
if not rows:
|
||||
return {"rows": [], "total": 0, "offset": offset, "limit": limit}
|
||||
|
||||
results: list[dict] = []
|
||||
ts_start = _parse_ts(time_start) if time_start else None
|
||||
ts_end = _parse_ts(time_end) if time_end else None
|
||||
|
||||
for r in rows:
|
||||
data = r.normalized_data or r.data
|
||||
|
||||
# Time filter
|
||||
if ts_start or ts_end:
|
||||
ts = _parse_ts(str(data.get("timestamp", "")))
|
||||
if ts:
|
||||
if ts_start and ts < ts_start:
|
||||
continue
|
||||
if ts_end and ts > ts_end:
|
||||
continue
|
||||
|
||||
# Field filters
|
||||
if filters:
|
||||
match = True
|
||||
for field, value in filters.items():
|
||||
field_val = str(data.get(field, "")).lower()
|
||||
if value.lower() not in field_val:
|
||||
match = False
|
||||
break
|
||||
if not match:
|
||||
continue
|
||||
|
||||
# Free-text search
|
||||
if query:
|
||||
q = query.lower()
|
||||
found = any(q in str(v).lower() for v in data.values())
|
||||
if not found:
|
||||
continue
|
||||
|
||||
results.append(data)
|
||||
|
||||
total = len(results)
|
||||
paged = results[offset:offset + limit]
|
||||
|
||||
return {"rows": paged, "total": total, "offset": offset, "limit": limit}
|
||||
|
||||
|
||||
# ── Internal helpers ──────────────────────────────────────────────────
|
||||
|
||||
|
||||
async def _fetch_rows(
|
||||
db: AsyncSession,
|
||||
dataset_id: str | None = None,
|
||||
hunt_id: str | None = None,
|
||||
limit: int = 50_000,
|
||||
) -> Sequence[DatasetRow]:
|
||||
stmt = select(DatasetRow).join(Dataset)
|
||||
if dataset_id:
|
||||
stmt = stmt.where(DatasetRow.dataset_id == dataset_id)
|
||||
elif hunt_id:
|
||||
stmt = stmt.where(Dataset.hunt_id == hunt_id)
|
||||
stmt = stmt.order_by(DatasetRow.row_index).limit(limit)
|
||||
result = await db.execute(stmt)
|
||||
return result.scalars().all()
|
||||
|
||||
|
||||
def _parse_ts(ts_str: str | None) -> datetime | None:
|
||||
"""Best-effort timestamp parsing."""
|
||||
if not ts_str:
|
||||
return None
|
||||
for fmt in (
|
||||
"%Y-%m-%dT%H:%M:%S.%fZ",
|
||||
"%Y-%m-%dT%H:%M:%SZ",
|
||||
"%Y-%m-%dT%H:%M:%S.%f",
|
||||
"%Y-%m-%dT%H:%M:%S",
|
||||
"%Y-%m-%d %H:%M:%S.%f",
|
||||
"%Y-%m-%d %H:%M:%S",
|
||||
"%m/%d/%Y %H:%M:%S",
|
||||
"%m/%d/%Y %I:%M:%S %p",
|
||||
):
|
||||
try:
|
||||
return datetime.strptime(ts_str.strip(), fmt)
|
||||
except (ValueError, AttributeError):
|
||||
continue
|
||||
return None
|
||||
|
||||
|
||||
def _classify_type(data: dict) -> str:
|
||||
if data.get("pid") or data.get("process_name"):
|
||||
if data.get("dst_ip") or data.get("dst_port"):
|
||||
return "network"
|
||||
return "process"
|
||||
if data.get("dst_ip") or data.get("src_ip"):
|
||||
return "network"
|
||||
if data.get("file_path"):
|
||||
return "file"
|
||||
return "other"
|
||||
589
backend/tests/generate_test_csvs.py
Normal file
589
backend/tests/generate_test_csvs.py
Normal file
@@ -0,0 +1,589 @@
|
||||
#!/usr/bin/env python3
|
||||
"""Generate 12 realistic Velociraptor-style CSV test files.
|
||||
|
||||
Mock network: 75 hosts, 10 users, 3 subnets.
|
||||
Sprinkles AUP-triggering keywords across DNS, URL, and process data.
|
||||
"""
|
||||
|
||||
import csv
|
||||
import os
|
||||
import random
|
||||
from datetime import datetime, timedelta
|
||||
from pathlib import Path
|
||||
|
||||
random.seed(42)
|
||||
|
||||
OUT = Path(__file__).parent / "test_csvs"
|
||||
OUT.mkdir(exist_ok=True)
|
||||
|
||||
# ── Shared network inventory ──────────────────────────────────────────
|
||||
|
||||
SUBNETS = ["10.10.1", "10.10.2", "10.10.3"]
|
||||
DEPARTMENTS = ["IT", "HR", "Finance", "Sales", "Engineering", "Legal", "Marketing", "Exec"]
|
||||
OS_LIST = ["Windows 10 Enterprise", "Windows 11 Enterprise", "Windows Server 2022", "Windows Server 2019"]
|
||||
DOMAIN = "acme.local"
|
||||
|
||||
HOSTS = []
|
||||
for i in range(1, 76):
|
||||
subnet = SUBNETS[i % 3]
|
||||
ip = f"{subnet}.{100 + i}"
|
||||
dept = DEPARTMENTS[i % len(DEPARTMENTS)]
|
||||
prefix = {"IT": "IT-WS", "HR": "HR-WS", "Finance": "FIN-WS", "Sales": "SLS-WS",
|
||||
"Engineering": "ENG-WS", "Legal": "LEG-WS", "Marketing": "MKT-WS", "Exec": "EXEC-WS"}
|
||||
hostname = f"{prefix.get(dept, 'WS')}-{i:03d}"
|
||||
os_ver = OS_LIST[i % len(OS_LIST)]
|
||||
mac = f"00:1A:2B:{i:02X}:{(i*3)%256:02X}:{(i*7)%256:02X}"
|
||||
HOSTS.append({"hostname": hostname, "ip": ip, "os": os_ver, "mac": mac, "dept": dept})
|
||||
|
||||
SERVERS = [
|
||||
{"hostname": "DC-01", "ip": "10.10.1.10", "os": "Windows Server 2022", "mac": "00:1A:2B:AA:01:01"},
|
||||
{"hostname": "DC-02", "ip": "10.10.2.10", "os": "Windows Server 2022", "mac": "00:1A:2B:AA:02:02"},
|
||||
{"hostname": "FILE-01", "ip": "10.10.1.11", "os": "Windows Server 2019", "mac": "00:1A:2B:AA:03:03"},
|
||||
{"hostname": "EXCH-01", "ip": "10.10.1.12", "os": "Windows Server 2022", "mac": "00:1A:2B:AA:04:04"},
|
||||
{"hostname": "WEB-01", "ip": "10.10.3.10", "os": "Windows Server 2022", "mac": "00:1A:2B:AA:05:05"},
|
||||
{"hostname": "SQL-01", "ip": "10.10.2.11", "os": "Windows Server 2019", "mac": "00:1A:2B:AA:06:06"},
|
||||
{"hostname": "PROXY-01", "ip": "10.10.1.13", "os": "Windows Server 2022", "mac": "00:1A:2B:AA:07:07"},
|
||||
]
|
||||
ALL_HOSTS = HOSTS + SERVERS
|
||||
|
||||
USERS = [
|
||||
"jsmith", "agarcia", "bwilson", "cjohnson", "dlee",
|
||||
"emartinez", "fthompson", "gwhite", "hbrown", "idavis",
|
||||
"admin", "svc_backup", "svc_sql", "svc_web",
|
||||
]
|
||||
|
||||
# Base time range: 2-week window
|
||||
BASE_TIME = datetime(2026, 2, 10, 8, 0, 0)
|
||||
END_TIME = datetime(2026, 2, 20, 18, 0, 0)
|
||||
|
||||
def rand_ts():
|
||||
delta = (END_TIME - BASE_TIME).total_seconds()
|
||||
return BASE_TIME + timedelta(seconds=random.uniform(0, delta))
|
||||
|
||||
def ts_str(dt=None):
|
||||
return (dt or rand_ts()).strftime("%Y-%m-%dT%H:%M:%S.%f")[:-3] + "Z"
|
||||
|
||||
def rand_host():
|
||||
return random.choice(ALL_HOSTS)
|
||||
|
||||
def rand_user():
|
||||
return random.choice(USERS)
|
||||
|
||||
def rand_ext_ip():
|
||||
return f"{random.randint(1,223)}.{random.randint(0,255)}.{random.randint(0,255)}.{random.randint(1,254)}"
|
||||
|
||||
# AUP trigger domains/URLs (will be sprinkled into DNS and proxy logs)
|
||||
AUP_DOMAINS = [
|
||||
"www.bet365.com", "pokerstars.com", "draftkings.com", # Gambling
|
||||
"store.steampowered.com", "steamcommunity.com", "discord.gg", # Gaming
|
||||
"www.netflix.com", "hulu.com", "open.spotify.com", # Streaming
|
||||
"thepiratebay.org", "1337x.to", "fitgirl-repacks.site", # Piracy
|
||||
"www.pornhub.com", "onlyfans.com", "xvideos.com", # Adult
|
||||
"www.facebook.com", "www.tiktok.com", "www.reddit.com", # Social Media
|
||||
"www.indeed.com", "www.glassdoor.com", "www.linkedin.com/jobs", # Job Search
|
||||
"www.amazon.com", "www.ebay.com", "www.shein.com", # Shopping
|
||||
]
|
||||
|
||||
AUP_PROCESSES = [
|
||||
"utorrent.exe", "qbittorrent.exe", "steam.exe", "discord.exe",
|
||||
"spotify.exe", "epicgameslauncher.exe",
|
||||
]
|
||||
|
||||
LEGIT_DOMAINS = [
|
||||
"login.microsoftonline.com", "outlook.office365.com", "teams.microsoft.com",
|
||||
"graph.microsoft.com", "update.microsoft.com", "windowsupdate.com",
|
||||
"acme.sharepoint.com", "acme.local", "dc-01.acme.local", "dc-02.acme.local",
|
||||
"file-01.acme.local", "exch-01.acme.local", "github.com", "stackoverflow.com",
|
||||
"cdn.jsdelivr.net", "pypi.org", "npmjs.com", "google.com", "googleapis.com",
|
||||
"cloudflare.com", "aws.amazon.com", "akamai.net", "time.windows.com",
|
||||
]
|
||||
|
||||
LEGIT_PROCESSES = [
|
||||
"svchost.exe", "explorer.exe", "chrome.exe", "msedge.exe", "outlook.exe",
|
||||
"teams.exe", "code.exe", "powershell.exe", "cmd.exe", "notepad.exe",
|
||||
"taskhostw.exe", "RuntimeBroker.exe", "SearchHost.exe", "lsass.exe",
|
||||
"csrss.exe", "winlogon.exe", "dwm.exe", "System", "smss.exe",
|
||||
"services.exe", "spoolsv.exe", "MsMpEng.exe", "OneDrive.exe",
|
||||
]
|
||||
|
||||
STATES = ["ESTABLISHED", "LISTEN", "TIME_WAIT", "CLOSE_WAIT", "SYN_SENT"]
|
||||
PROTOCOLS = ["TCP", "UDP", "TCP", "TCP", "TCP"]
|
||||
|
||||
def write_csv(filename, headers, rows):
|
||||
path = OUT / filename
|
||||
with open(path, "w", newline="", encoding="utf-8") as f:
|
||||
w = csv.DictWriter(f, fieldnames=headers)
|
||||
w.writeheader()
|
||||
w.writerows(rows)
|
||||
print(f" {filename}: {len(rows)} rows")
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 1. Netstat connections (Velociraptor: Windows.Network.Netstat)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_netstat():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
n_conns = random.randint(8, 40)
|
||||
for _ in range(n_conns):
|
||||
proc = random.choice(LEGIT_PROCESSES + (AUP_PROCESSES if random.random() < 0.08 else []))
|
||||
state = random.choice(STATES)
|
||||
proto = random.choice(PROTOCOLS)
|
||||
local_port = random.choice([80, 443, 445, 135, 139, 3389, 5985, 8080, 53, 88, 389, 636,
|
||||
random.randint(49152, 65535)])
|
||||
if state == "LISTEN":
|
||||
remote_ip = "0.0.0.0"
|
||||
remote_port = 0
|
||||
else:
|
||||
remote_ip = random.choice([rand_ext_ip(), random.choice(ALL_HOSTS)["ip"]])
|
||||
remote_port = random.choice([80, 443, 8080, 3389, 445, 53, 88, 389, 636,
|
||||
random.randint(1024, 65535)])
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"Timestamp": ts_str(),
|
||||
"Pid": random.randint(100, 65000),
|
||||
"Name": proc,
|
||||
"Status": state,
|
||||
"Protocol": proto,
|
||||
"Laddr.IP": host["ip"],
|
||||
"Laddr.Port": local_port,
|
||||
"Raddr.IP": remote_ip,
|
||||
"Raddr.Port": remote_port,
|
||||
"Username": rand_user(),
|
||||
})
|
||||
return rows
|
||||
|
||||
print("Generating Velociraptor test CSVs...")
|
||||
rows = gen_netstat()
|
||||
write_csv("01_netstat_connections.csv",
|
||||
["Hostname", "Timestamp", "Pid", "Name", "Status", "Protocol",
|
||||
"Laddr.IP", "Laddr.Port", "Raddr.IP", "Raddr.Port", "Username"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 2. DNS queries (Velociraptor: Windows.Network.DNS)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_dns():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
n_queries = random.randint(15, 60)
|
||||
for _ in range(n_queries):
|
||||
if random.random() < 0.12:
|
||||
domain = random.choice(AUP_DOMAINS)
|
||||
else:
|
||||
domain = random.choice(LEGIT_DOMAINS)
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"EventTime": ts_str(),
|
||||
"QueryName": domain,
|
||||
"QueryType": random.choice(["A", "AAAA", "CNAME", "MX", "TXT", "A", "A"]),
|
||||
"ResponseCode": random.choice(["NOERROR", "NOERROR", "NOERROR", "NXDOMAIN", "SERVFAIL"]),
|
||||
"SourceIP": host["ip"],
|
||||
"AnswerIP": rand_ext_ip() if random.random() > 0.2 else "",
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_dns()
|
||||
write_csv("02_dns_queries.csv",
|
||||
["Hostname", "EventTime", "QueryName", "QueryType", "ResponseCode", "SourceIP", "AnswerIP"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 3. Process listing (Velociraptor: Windows.System.Pslist)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_pslist():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
user = rand_user()
|
||||
for proc in LEGIT_PROCESSES:
|
||||
pid = random.randint(100, 65000)
|
||||
ppid = random.randint(1, 20) if proc in ("svchost.exe", "csrss.exe", "lsass.exe") else random.randint(100, 60000)
|
||||
rows.append({
|
||||
"ComputerName": host["hostname"],
|
||||
"CreateTime": ts_str(),
|
||||
"Pid": pid,
|
||||
"PPid": ppid,
|
||||
"Name": proc,
|
||||
"CommandLine": f"C:\\Windows\\System32\\{proc}" if proc != "System" else "System",
|
||||
"Username": f"ACME\\{user}" if proc not in ("System", "smss.exe", "csrss.exe") else "NT AUTHORITY\\SYSTEM",
|
||||
"MemoryUsage": random.randint(1024, 500000),
|
||||
})
|
||||
# Sprinkle AUP processes on ~15% of hosts
|
||||
if random.random() < 0.15:
|
||||
aup_proc = random.choice(AUP_PROCESSES)
|
||||
rows.append({
|
||||
"ComputerName": host["hostname"],
|
||||
"CreateTime": ts_str(),
|
||||
"Pid": random.randint(10000, 65000),
|
||||
"PPid": random.randint(100, 60000),
|
||||
"Name": aup_proc,
|
||||
"CommandLine": f"C:\\Users\\{user}\\AppData\\Local\\{aup_proc.replace('.exe', '')}\\{aup_proc}",
|
||||
"Username": f"ACME\\{user}",
|
||||
"MemoryUsage": random.randint(50000, 400000),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_pslist()
|
||||
write_csv("03_process_listing.csv",
|
||||
["ComputerName", "CreateTime", "Pid", "PPid", "Name", "CommandLine", "Username", "MemoryUsage"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 4. Network interfaces (Velociraptor: Windows.Network.Interfaces)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_interfaces():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
h = host
|
||||
rows.append({
|
||||
"Hostname": h["hostname"],
|
||||
"Timestamp": ts_str(),
|
||||
"Name": "Ethernet0",
|
||||
"MacAddress": h.get("mac", f"00:1A:2B:{random.randint(0,255):02X}:{random.randint(0,255):02X}:{random.randint(0,255):02X}"),
|
||||
"IP": h["ip"],
|
||||
"Netmask": "255.255.255.0",
|
||||
"Gateway": h["ip"].rsplit(".", 1)[0] + ".1",
|
||||
"DNSServer": "10.10.1.10",
|
||||
"DHCPEnabled": random.choice(["True", "False"]),
|
||||
"Status": "Up",
|
||||
})
|
||||
# Some hosts have a secondary NIC
|
||||
if random.random() < 0.15:
|
||||
rows.append({
|
||||
"Hostname": h["hostname"],
|
||||
"Timestamp": ts_str(),
|
||||
"Name": "WiFi",
|
||||
"MacAddress": f"00:1A:2B:{random.randint(0,255):02X}:{random.randint(0,255):02X}:{random.randint(0,255):02X}",
|
||||
"IP": f"192.168.1.{random.randint(100,254)}",
|
||||
"Netmask": "255.255.255.0",
|
||||
"Gateway": "192.168.1.1",
|
||||
"DNSServer": "192.168.1.1",
|
||||
"DHCPEnabled": "True",
|
||||
"Status": "Up",
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_interfaces()
|
||||
write_csv("04_network_interfaces.csv",
|
||||
["Hostname", "Timestamp", "Name", "MacAddress", "IP", "Netmask", "Gateway", "DNSServer", "DHCPEnabled", "Status"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 5. Logged-in users (Velociraptor: Windows.Sys.Users)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_logged_users():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
n_users = random.randint(1, 3)
|
||||
used = set()
|
||||
for _ in range(n_users):
|
||||
u = rand_user()
|
||||
while u in used:
|
||||
u = rand_user()
|
||||
used.add(u)
|
||||
logon_ts = rand_ts()
|
||||
rows.append({
|
||||
"ComputerName": host["hostname"],
|
||||
"SourceIP": host["ip"],
|
||||
"User": f"ACME\\{u}",
|
||||
"LogonType": random.choice([2, 3, 10, 10, 2]), # 2=Interactive, 3=Network, 10=RDP
|
||||
"LogonTime": ts_str(logon_ts),
|
||||
"LogoffTime": ts_str(logon_ts + timedelta(hours=random.uniform(0.5, 10))) if random.random() > 0.3 else "",
|
||||
"OS": host.get("os", "Windows 10 Enterprise"),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_logged_users()
|
||||
write_csv("05_logged_in_users.csv",
|
||||
["ComputerName", "SourceIP", "User", "LogonType", "LogonTime", "LogoffTime", "OS"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 6. Scheduled tasks (Velociraptor: Windows.System.TaskScheduler)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
SCHED_TASKS = [
|
||||
("\\Microsoft\\Windows\\UpdateOrchestrator\\Schedule Scan", "C:\\Windows\\System32\\usoclient.exe StartScan"),
|
||||
("\\Microsoft\\Windows\\Defrag\\ScheduledDefrag", "C:\\Windows\\System32\\defrag.exe -c -h -o"),
|
||||
("\\Microsoft\\Windows\\WindowsUpdate\\Automatic App Update", "C:\\Windows\\System32\\UsoClient.exe"),
|
||||
("\\ACME\\Backup", "C:\\Tools\\backup.ps1"),
|
||||
("\\ACME\\Inventory", "C:\\Tools\\inventory.exe --scan"),
|
||||
]
|
||||
|
||||
def gen_sched_tasks():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
for task_name, cmd in SCHED_TASKS:
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"IP": host["ip"],
|
||||
"TaskName": task_name,
|
||||
"CommandLine": cmd,
|
||||
"Enabled": random.choice(["True", "True", "True", "False"]),
|
||||
"LastRunTime": ts_str(),
|
||||
"NextRunTime": ts_str(),
|
||||
"Username": "NT AUTHORITY\\SYSTEM" if "Microsoft" in task_name else f"ACME\\svc_backup",
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_sched_tasks()
|
||||
write_csv("06_scheduled_tasks.csv",
|
||||
["Hostname", "IP", "TaskName", "CommandLine", "Enabled", "LastRunTime", "NextRunTime", "Username"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 7. Browser history (Velociraptor: Windows.Application.Chrome.History)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_browser_history():
|
||||
rows = []
|
||||
for host in HOSTS: # only workstations
|
||||
user = rand_user()
|
||||
n_entries = random.randint(10, 35)
|
||||
for _ in range(n_entries):
|
||||
if random.random() < 0.15:
|
||||
domain = random.choice(AUP_DOMAINS)
|
||||
url = f"https://{domain}/{random.choice(['', 'home', 'watch', 'play', 'search?q=free+movies', 'category/popular'])}"
|
||||
title_map = {
|
||||
"bet365": "Bet365 - Sports Betting",
|
||||
"pokerstars": "PokerStars - Online Poker",
|
||||
"netflix": "Netflix - Watch TV Shows",
|
||||
"steam": "Steam Store",
|
||||
"piratebay": "The Pirate Bay",
|
||||
"pornhub": "Pornhub",
|
||||
"facebook": "Facebook - Log In",
|
||||
"tiktok": "TikTok - Make Your Day",
|
||||
"indeed": "Indeed - Job Search",
|
||||
"amazon": "Amazon.com - Shopping",
|
||||
}
|
||||
title = next((v for k, v in title_map.items() if k in domain), domain)
|
||||
else:
|
||||
domain = random.choice(LEGIT_DOMAINS)
|
||||
url = f"https://{domain}/{random.choice(['', 'docs', 'api', 'search', 'dashboard', 'inbox'])}"
|
||||
title = domain
|
||||
rows.append({
|
||||
"ComputerName": host["hostname"],
|
||||
"SourceAddress": host["ip"],
|
||||
"User": user,
|
||||
"URL": url,
|
||||
"Title": title,
|
||||
"VisitTime": ts_str(),
|
||||
"VisitCount": random.randint(1, 20),
|
||||
"Browser": random.choice(["Chrome", "Edge", "Chrome", "Chrome"]),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_browser_history()
|
||||
write_csv("07_browser_history.csv",
|
||||
["ComputerName", "SourceAddress", "User", "URL", "Title", "VisitTime", "VisitCount", "Browser"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 8. Sysmon network connections (Sysmon Event ID 3)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_sysmon_network():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
n_events = random.randint(10, 50)
|
||||
user = rand_user()
|
||||
for _ in range(n_events):
|
||||
proc = random.choice(LEGIT_PROCESSES + (["chrome.exe", "msedge.exe"] * 3))
|
||||
dst_ip = random.choice([rand_ext_ip(), random.choice(ALL_HOSTS)["ip"]])
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"EventTime": ts_str(),
|
||||
"EventID": 3,
|
||||
"Image": f"C:\\Windows\\System32\\{proc}" if proc not in ("chrome.exe", "msedge.exe") else f"C:\\Program Files\\{proc}",
|
||||
"User": f"ACME\\{user}",
|
||||
"Protocol": random.choice(["tcp", "udp"]),
|
||||
"SourceIp": host["ip"],
|
||||
"SourcePort": random.randint(49152, 65535),
|
||||
"DestinationIp": dst_ip,
|
||||
"DestinationPort": random.choice([80, 443, 53, 445, 389, 3389, 8080]),
|
||||
"DestinationHostname": random.choice(LEGIT_DOMAINS + AUP_DOMAINS[:3]) if random.random() < 0.1 else "",
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_sysmon_network()
|
||||
write_csv("08_sysmon_network.csv",
|
||||
["Hostname", "EventTime", "EventID", "Image", "User", "Protocol",
|
||||
"SourceIp", "SourcePort", "DestinationIp", "DestinationPort", "DestinationHostname"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 9. Autoruns (Velociraptor: Windows.Sys.AutoRuns)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
AUTORUN_ENTRIES = [
|
||||
("MicrosoftEdgeAutoLaunch", "C:\\Program Files\\Microsoft\\Edge\\msedge.exe --no-startup-window"),
|
||||
("SecurityHealth", "C:\\Windows\\System32\\SecurityHealthSystray.exe"),
|
||||
("OneDrive", "C:\\Users\\{user}\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe /background"),
|
||||
("WindowsDefender", "C:\\ProgramData\\Microsoft\\Windows Defender\\MsMpEng.exe"),
|
||||
]
|
||||
|
||||
AUP_AUTORUNS = [
|
||||
("Steam", "C:\\Program Files (x86)\\Steam\\steam.exe -silent"),
|
||||
("Discord", "C:\\Users\\{user}\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"),
|
||||
("Spotify", "C:\\Users\\{user}\\AppData\\Roaming\\Spotify\\Spotify.exe /minimized"),
|
||||
("uTorrent", "C:\\Users\\{user}\\AppData\\Roaming\\uTorrent\\uTorrent.exe /minimized"),
|
||||
]
|
||||
|
||||
def gen_autoruns():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
user = rand_user()
|
||||
for name, cmd in AUTORUN_ENTRIES:
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"IP": host["ip"],
|
||||
"EntryName": name,
|
||||
"EntryPath": cmd.replace("{user}", user),
|
||||
"Category": "Logon",
|
||||
"Enabled": "True",
|
||||
"Signer": "Microsoft Corporation" if "Microsoft" in cmd or "Windows" in cmd else "(Not Signed)",
|
||||
"MD5": f"{random.randint(0, 2**128):032x}",
|
||||
"Timestamp": ts_str(),
|
||||
})
|
||||
# ~20% of workstations have AUP autoruns
|
||||
if host in HOSTS and random.random() < 0.20:
|
||||
entry = random.choice(AUP_AUTORUNS)
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"IP": host["ip"],
|
||||
"EntryName": entry[0],
|
||||
"EntryPath": entry[1].replace("{user}", user),
|
||||
"Category": "Logon",
|
||||
"Enabled": "True",
|
||||
"Signer": "(Not Signed)",
|
||||
"MD5": f"{random.randint(0, 2**128):032x}",
|
||||
"Timestamp": ts_str(),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_autoruns()
|
||||
write_csv("09_autoruns.csv",
|
||||
["Hostname", "IP", "EntryName", "EntryPath", "Category", "Enabled", "Signer", "MD5", "Timestamp"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 10. Windows Event Logs — Logon events (Event IDs 4624/4625)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_logon_events():
|
||||
rows = []
|
||||
for host in ALL_HOSTS:
|
||||
n_events = random.randint(8, 30)
|
||||
for _ in range(n_events):
|
||||
event_id = random.choice([4624, 4624, 4624, 4624, 4625])
|
||||
logon_type = random.choice([2, 3, 7, 10, 3, 3])
|
||||
user = rand_user()
|
||||
src_ip = random.choice([host["ip"], random.choice(ALL_HOSTS)["ip"], "127.0.0.1"])
|
||||
rows.append({
|
||||
"ComputerName": host["hostname"],
|
||||
"System.TimeCreated": ts_str(),
|
||||
"EventID": event_id,
|
||||
"LogonType": logon_type,
|
||||
"SubjectUserName": user,
|
||||
"SubjectUserSid": f"S-1-5-21-{random.randint(1000000,9999999)}-{random.randint(1000,9999)}",
|
||||
"SourceAddress": src_ip,
|
||||
"SourcePort": random.randint(1024, 65535),
|
||||
"Status": "0x0" if event_id == 4624 else "0xC000006D",
|
||||
"FailureReason": "" if event_id == 4624 else "Unknown user name or bad password",
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_logon_events()
|
||||
write_csv("10_logon_events.csv",
|
||||
["ComputerName", "System.TimeCreated", "EventID", "LogonType",
|
||||
"SubjectUserName", "SubjectUserSid", "SourceAddress", "SourcePort",
|
||||
"Status", "FailureReason"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 11. Proxy / web filter logs
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
def gen_proxy_logs():
|
||||
rows = []
|
||||
for host in HOSTS: # workstations only
|
||||
n_entries = random.randint(15, 50)
|
||||
user = rand_user()
|
||||
for _ in range(n_entries):
|
||||
if random.random() < 0.10:
|
||||
dom = random.choice(AUP_DOMAINS)
|
||||
url = f"https://{dom}/"
|
||||
action = random.choice(["BLOCKED", "ALLOWED", "ALLOWED"])
|
||||
category = random.choice(["Gambling", "Gaming", "Streaming", "Adult", "Social Media", "Shopping", "Piracy"])
|
||||
else:
|
||||
dom = random.choice(LEGIT_DOMAINS)
|
||||
url = f"https://{dom}/api/v1/resource"
|
||||
action = "ALLOWED"
|
||||
category = random.choice(["Business", "Technology", "Cloud Services", "Productivity"])
|
||||
rows.append({
|
||||
"Timestamp": ts_str(),
|
||||
"Hostname": host["hostname"],
|
||||
"SourceIP": host["ip"],
|
||||
"Username": f"ACME\\{user}",
|
||||
"URL": url,
|
||||
"Domain": dom,
|
||||
"Action": action,
|
||||
"Category": category,
|
||||
"Method": random.choice(["GET", "POST", "GET", "GET"]),
|
||||
"ResponseCode": random.choice([200, 200, 200, 301, 403, 404]) if action == "ALLOWED" else 403,
|
||||
"BytesSent": random.randint(100, 50000),
|
||||
"BytesReceived": random.randint(500, 500000),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_proxy_logs()
|
||||
write_csv("11_proxy_logs.csv",
|
||||
["Timestamp", "Hostname", "SourceIP", "Username", "URL", "Domain",
|
||||
"Action", "Category", "Method", "ResponseCode", "BytesSent", "BytesReceived"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# 12. File listing — suspicious downloads (Velociraptor: Windows.Search.FileFinder)
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
DOWNLOAD_FILES = [
|
||||
("Q1_Budget_2026.xlsx", 245000, "a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6"),
|
||||
("meeting_notes.docx", 89000, "b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7"),
|
||||
("vpn_config.ovpn", 1200, "c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8"),
|
||||
("project_plan.pptx", 1500000, "d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9"),
|
||||
("setup.exe", 45000000, "e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0"),
|
||||
("crack_photoshop.exe", 12000000, "f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1"), # AUP
|
||||
("keygen_v2.exe", 500000, "a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2"), # AUP
|
||||
("steam_installer.exe", 3500000, "b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3"), # AUP
|
||||
("free_movie_2026.torrent", 45000, "c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4"), # AUP
|
||||
("salary_comparison.pdf", 320000, "d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5"),
|
||||
]
|
||||
|
||||
def gen_file_listing():
|
||||
rows = []
|
||||
for host in HOSTS:
|
||||
user = rand_user()
|
||||
n_files = random.randint(3, 8)
|
||||
selected = random.sample(DOWNLOAD_FILES, min(n_files, len(DOWNLOAD_FILES)))
|
||||
for fname, size, md5 in selected:
|
||||
rows.append({
|
||||
"Hostname": host["hostname"],
|
||||
"SourceIP": host["ip"],
|
||||
"FullPath": f"C:\\Users\\{user}\\Downloads\\{fname}",
|
||||
"FileName": fname,
|
||||
"Size": size,
|
||||
"MD5": md5,
|
||||
"SHA256": f"{random.randint(0, 2**256):064x}",
|
||||
"MTime": ts_str(),
|
||||
"CTime": ts_str(),
|
||||
"Username": f"ACME\\{user}",
|
||||
"OS": host.get("os", "Windows 10 Enterprise"),
|
||||
})
|
||||
return rows
|
||||
|
||||
rows = gen_file_listing()
|
||||
write_csv("12_file_listing.csv",
|
||||
["Hostname", "SourceIP", "FullPath", "FileName", "Size", "MD5", "SHA256",
|
||||
"MTime", "CTime", "Username", "OS"], rows)
|
||||
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
# Summary
|
||||
# ═══════════════════════════════════════════════════════════════════════
|
||||
|
||||
total = sum(len(list((OUT / f).open())) - 1 for f in os.listdir(OUT) if f.endswith(".csv"))
|
||||
print(f"\nDone! 12 CSV files in {OUT}")
|
||||
print(f"Network: {len(ALL_HOSTS)} hosts, {len(USERS)} users, {len(SUBNETS)} subnets")
|
||||
print(f"AUP triggers in: DNS, browser history, proxy logs, autoruns, file listing, process list, sysmon")
|
||||
2013
backend/tests/test_csvs/01_netstat_connections.csv
Normal file
2013
backend/tests/test_csvs/01_netstat_connections.csv
Normal file
File diff suppressed because it is too large
Load Diff
2965
backend/tests/test_csvs/02_dns_queries.csv
Normal file
2965
backend/tests/test_csvs/02_dns_queries.csv
Normal file
File diff suppressed because it is too large
Load Diff
1897
backend/tests/test_csvs/03_process_listing.csv
Normal file
1897
backend/tests/test_csvs/03_process_listing.csv
Normal file
File diff suppressed because it is too large
Load Diff
95
backend/tests/test_csvs/04_network_interfaces.csv
Normal file
95
backend/tests/test_csvs/04_network_interfaces.csv
Normal file
@@ -0,0 +1,95 @@
|
||||
Hostname,Timestamp,Name,MacAddress,IP,Netmask,Gateway,DNSServer,DHCPEnabled,Status
|
||||
HR-WS-001,2026-02-10T16:24:26.900Z,Ethernet0,00:1A:2B:01:03:07,10.10.2.101,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
FIN-WS-002,2026-02-12T21:40:50.754Z,Ethernet0,00:1A:2B:02:06:0E,10.10.3.102,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
SLS-WS-003,2026-02-18T04:41:53.395Z,Ethernet0,00:1A:2B:03:09:15,10.10.1.103,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
ENG-WS-004,2026-02-10T09:17:24.303Z,Ethernet0,00:1A:2B:04:0C:1C,10.10.2.104,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
LEG-WS-005,2026-02-17T19:14:58.917Z,Ethernet0,00:1A:2B:05:0F:23,10.10.3.105,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
MKT-WS-006,2026-02-14T17:52:45.679Z,Ethernet0,00:1A:2B:06:12:2A,10.10.1.106,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
EXEC-WS-007,2026-02-12T06:47:59.653Z,Ethernet0,00:1A:2B:07:15:31,10.10.2.107,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
IT-WS-008,2026-02-13T00:45:43.505Z,Ethernet0,00:1A:2B:08:18:38,10.10.3.108,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
HR-WS-009,2026-02-16T10:06:59.053Z,Ethernet0,00:1A:2B:09:1B:3F,10.10.1.109,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
FIN-WS-010,2026-02-15T17:42:42.094Z,Ethernet0,00:1A:2B:0A:1E:46,10.10.2.110,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
SLS-WS-011,2026-02-17T22:02:06.433Z,Ethernet0,00:1A:2B:0B:21:4D,10.10.3.111,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
ENG-WS-012,2026-02-19T05:25:25.672Z,Ethernet0,00:1A:2B:0C:24:54,10.10.1.112,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
LEG-WS-013,2026-02-16T20:31:43.770Z,Ethernet0,00:1A:2B:0D:27:5B,10.10.2.113,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
MKT-WS-014,2026-02-17T09:41:02.510Z,Ethernet0,00:1A:2B:0E:2A:62,10.10.3.114,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
EXEC-WS-015,2026-02-15T10:28:26.740Z,Ethernet0,00:1A:2B:0F:2D:69,10.10.1.115,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
EXEC-WS-015,2026-02-10T11:51:53.112Z,WiFi,00:1A:2B:55:56:F5,192.168.1.253,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
IT-WS-016,2026-02-16T04:21:28.306Z,Ethernet0,00:1A:2B:10:30:70,10.10.2.116,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
HR-WS-017,2026-02-16T17:05:22.194Z,Ethernet0,00:1A:2B:11:33:77,10.10.3.117,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
FIN-WS-018,2026-02-12T18:00:28.942Z,Ethernet0,00:1A:2B:12:36:7E,10.10.1.118,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
SLS-WS-019,2026-02-15T04:56:45.920Z,Ethernet0,00:1A:2B:13:39:85,10.10.2.119,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
ENG-WS-020,2026-02-11T10:01:43.793Z,Ethernet0,00:1A:2B:14:3C:8C,10.10.3.120,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
LEG-WS-021,2026-02-11T21:06:19.348Z,Ethernet0,00:1A:2B:15:3F:93,10.10.1.121,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
MKT-WS-022,2026-02-10T20:29:46.294Z,Ethernet0,00:1A:2B:16:42:9A,10.10.2.122,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
EXEC-WS-023,2026-02-11T19:04:20.910Z,Ethernet0,00:1A:2B:17:45:A1,10.10.3.123,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
IT-WS-024,2026-02-16T09:50:42.318Z,Ethernet0,00:1A:2B:18:48:A8,10.10.1.124,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
IT-WS-024,2026-02-14T22:30:35.434Z,WiFi,00:1A:2B:BF:1F:78,192.168.1.203,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
HR-WS-025,2026-02-13T09:55:26.913Z,Ethernet0,00:1A:2B:19:4B:AF,10.10.2.125,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
FIN-WS-026,2026-02-16T17:25:01.286Z,Ethernet0,00:1A:2B:1A:4E:B6,10.10.3.126,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
SLS-WS-027,2026-02-14T18:31:05.971Z,Ethernet0,00:1A:2B:1B:51:BD,10.10.1.127,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
ENG-WS-028,2026-02-20T14:27:15.813Z,Ethernet0,00:1A:2B:1C:54:C4,10.10.2.128,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
LEG-WS-029,2026-02-20T12:27:41.544Z,Ethernet0,00:1A:2B:1D:57:CB,10.10.3.129,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
LEG-WS-029,2026-02-16T09:22:52.989Z,WiFi,00:1A:2B:E0:FE:1A,192.168.1.111,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
MKT-WS-030,2026-02-15T04:55:56.987Z,Ethernet0,00:1A:2B:1E:5A:D2,10.10.1.130,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
EXEC-WS-031,2026-02-12T14:44:11.880Z,Ethernet0,00:1A:2B:1F:5D:D9,10.10.2.131,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
IT-WS-032,2026-02-15T05:33:06.487Z,Ethernet0,00:1A:2B:20:60:E0,10.10.3.132,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
HR-WS-033,2026-02-11T05:39:51.291Z,Ethernet0,00:1A:2B:21:63:E7,10.10.1.133,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
FIN-WS-034,2026-02-11T11:33:18.757Z,Ethernet0,00:1A:2B:22:66:EE,10.10.2.134,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
SLS-WS-035,2026-02-11T00:04:29.942Z,Ethernet0,00:1A:2B:23:69:F5,10.10.3.135,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
ENG-WS-036,2026-02-17T14:12:29.280Z,Ethernet0,00:1A:2B:24:6C:FC,10.10.1.136,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
LEG-WS-037,2026-02-14T08:36:09.053Z,Ethernet0,00:1A:2B:25:6F:03,10.10.2.137,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
MKT-WS-038,2026-02-17T03:32:51.019Z,Ethernet0,00:1A:2B:26:72:0A,10.10.3.138,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
EXEC-WS-039,2026-02-12T14:30:02.287Z,Ethernet0,00:1A:2B:27:75:11,10.10.1.139,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
IT-WS-040,2026-02-16T05:42:19.535Z,Ethernet0,00:1A:2B:28:78:18,10.10.2.140,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
HR-WS-041,2026-02-12T22:00:14.852Z,Ethernet0,00:1A:2B:29:7B:1F,10.10.3.141,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
FIN-WS-042,2026-02-14T08:06:34.719Z,Ethernet0,00:1A:2B:2A:7E:26,10.10.1.142,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
SLS-WS-043,2026-02-15T09:46:46.751Z,Ethernet0,00:1A:2B:2B:81:2D,10.10.2.143,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
ENG-WS-044,2026-02-13T22:35:19.386Z,Ethernet0,00:1A:2B:2C:84:34,10.10.3.144,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
LEG-WS-045,2026-02-16T14:36:44.741Z,Ethernet0,00:1A:2B:2D:87:3B,10.10.1.145,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
MKT-WS-046,2026-02-10T20:21:06.160Z,Ethernet0,00:1A:2B:2E:8A:42,10.10.2.146,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
EXEC-WS-047,2026-02-13T17:28:04.672Z,Ethernet0,00:1A:2B:2F:8D:49,10.10.3.147,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
EXEC-WS-047,2026-02-15T05:39:34.377Z,WiFi,00:1A:2B:56:C7:C5,192.168.1.173,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
IT-WS-048,2026-02-10T12:18:07.676Z,Ethernet0,00:1A:2B:30:90:50,10.10.1.148,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
IT-WS-048,2026-02-16T04:58:53.462Z,WiFi,00:1A:2B:0D:DC:8E,192.168.1.105,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
HR-WS-049,2026-02-15T16:58:23.088Z,Ethernet0,00:1A:2B:31:93:57,10.10.2.149,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
HR-WS-049,2026-02-11T10:08:21.611Z,WiFi,00:1A:2B:C0:BD:32,192.168.1.104,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
FIN-WS-050,2026-02-18T17:07:33.846Z,Ethernet0,00:1A:2B:32:96:5E,10.10.3.150,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
SLS-WS-051,2026-02-17T21:04:50.875Z,Ethernet0,00:1A:2B:33:99:65,10.10.1.151,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
ENG-WS-052,2026-02-12T08:55:29.512Z,Ethernet0,00:1A:2B:34:9C:6C,10.10.2.152,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
LEG-WS-053,2026-02-17T19:12:11.653Z,Ethernet0,00:1A:2B:35:9F:73,10.10.3.153,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
MKT-WS-054,2026-02-11T10:29:55.699Z,Ethernet0,00:1A:2B:36:A2:7A,10.10.1.154,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
EXEC-WS-055,2026-02-19T22:37:21.448Z,Ethernet0,00:1A:2B:37:A5:81,10.10.2.155,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
EXEC-WS-055,2026-02-15T04:05:15.992Z,WiFi,00:1A:2B:6F:0B:FB,192.168.1.234,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
IT-WS-056,2026-02-11T14:10:01.331Z,Ethernet0,00:1A:2B:38:A8:88,10.10.3.156,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
HR-WS-057,2026-02-19T21:26:13.167Z,Ethernet0,00:1A:2B:39:AB:8F,10.10.1.157,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
FIN-WS-058,2026-02-15T03:50:27.520Z,Ethernet0,00:1A:2B:3A:AE:96,10.10.2.158,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
SLS-WS-059,2026-02-15T13:42:58.594Z,Ethernet0,00:1A:2B:3B:B1:9D,10.10.3.159,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
ENG-WS-060,2026-02-14T20:41:02.310Z,Ethernet0,00:1A:2B:3C:B4:A4,10.10.1.160,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
LEG-WS-061,2026-02-13T22:18:10.231Z,Ethernet0,00:1A:2B:3D:B7:AB,10.10.2.161,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
LEG-WS-061,2026-02-13T20:39:08.097Z,WiFi,00:1A:2B:98:B3:9A,192.168.1.212,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
MKT-WS-062,2026-02-16T06:02:40.122Z,Ethernet0,00:1A:2B:3E:BA:B2,10.10.3.162,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
EXEC-WS-063,2026-02-19T05:26:24.391Z,Ethernet0,00:1A:2B:3F:BD:B9,10.10.1.163,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
IT-WS-064,2026-02-16T10:52:03.498Z,Ethernet0,00:1A:2B:40:C0:C0,10.10.2.164,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
HR-WS-065,2026-02-16T06:51:58.416Z,Ethernet0,00:1A:2B:41:C3:C7,10.10.3.165,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
FIN-WS-066,2026-02-12T21:32:27.236Z,Ethernet0,00:1A:2B:42:C6:CE,10.10.1.166,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
SLS-WS-067,2026-02-14T09:35:36.931Z,Ethernet0,00:1A:2B:43:C9:D5,10.10.2.167,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
ENG-WS-068,2026-02-17T01:03:57.807Z,Ethernet0,00:1A:2B:44:CC:DC,10.10.3.168,255.255.255.0,10.10.3.1,10.10.1.10,True,Up
|
||||
LEG-WS-069,2026-02-18T07:35:16.538Z,Ethernet0,00:1A:2B:45:CF:E3,10.10.1.169,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
MKT-WS-070,2026-02-13T22:47:29.628Z,Ethernet0,00:1A:2B:46:D2:EA,10.10.2.170,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
EXEC-WS-071,2026-02-10T22:35:50.568Z,Ethernet0,00:1A:2B:47:D5:F1,10.10.3.171,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
IT-WS-072,2026-02-10T18:39:18.543Z,Ethernet0,00:1A:2B:48:D8:F8,10.10.1.172,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
HR-WS-073,2026-02-15T02:52:48.715Z,Ethernet0,00:1A:2B:49:DB:FF,10.10.2.173,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
FIN-WS-074,2026-02-16T15:48:43.982Z,Ethernet0,00:1A:2B:4A:DE:06,10.10.3.174,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
FIN-WS-074,2026-02-15T03:16:41.128Z,WiFi,00:1A:2B:E5:58:D5,192.168.1.187,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
SLS-WS-075,2026-02-13T19:56:33.469Z,Ethernet0,00:1A:2B:4B:E1:0D,10.10.1.175,255.255.255.0,10.10.1.1,10.10.1.10,False,Up
|
||||
SLS-WS-075,2026-02-13T19:51:59.764Z,WiFi,00:1A:2B:85:45:E7,192.168.1.101,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
DC-01,2026-02-11T04:33:29.426Z,Ethernet0,00:1A:2B:AA:01:01,10.10.1.10,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
DC-02,2026-02-19T18:46:33.305Z,Ethernet0,00:1A:2B:AA:02:02,10.10.2.10,255.255.255.0,10.10.2.1,10.10.1.10,True,Up
|
||||
DC-02,2026-02-18T23:30:06.254Z,WiFi,00:1A:2B:CC:F1:9E,192.168.1.104,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
FILE-01,2026-02-18T11:12:43.756Z,Ethernet0,00:1A:2B:AA:03:03,10.10.1.11,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
FILE-01,2026-02-11T03:22:46.203Z,WiFi,00:1A:2B:CE:97:70,192.168.1.182,255.255.255.0,192.168.1.1,192.168.1.1,True,Up
|
||||
EXCH-01,2026-02-19T04:32:00.039Z,Ethernet0,00:1A:2B:AA:04:04,10.10.1.12,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
WEB-01,2026-02-18T10:09:44.001Z,Ethernet0,00:1A:2B:AA:05:05,10.10.3.10,255.255.255.0,10.10.3.1,10.10.1.10,False,Up
|
||||
SQL-01,2026-02-11T21:40:03.308Z,Ethernet0,00:1A:2B:AA:06:06,10.10.2.11,255.255.255.0,10.10.2.1,10.10.1.10,False,Up
|
||||
PROXY-01,2026-02-15T18:13:44.315Z,Ethernet0,00:1A:2B:AA:07:07,10.10.1.13,255.255.255.0,10.10.1.1,10.10.1.10,True,Up
|
||||
|
172
backend/tests/test_csvs/05_logged_in_users.csv
Normal file
172
backend/tests/test_csvs/05_logged_in_users.csv
Normal file
@@ -0,0 +1,172 @@
|
||||
ComputerName,SourceIP,User,LogonType,LogonTime,LogoffTime,OS
|
||||
HR-WS-001,10.10.2.101,ACME\svc_backup,3,2026-02-10T19:47:11.019Z,,Windows 11 Enterprise
|
||||
FIN-WS-002,10.10.3.102,ACME\svc_sql,2,2026-02-20T13:32:12.532Z,,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,ACME\jsmith,3,2026-02-11T07:54:47.111Z,2026-02-11T09:12:28.977Z,Windows Server 2022
|
||||
SLS-WS-003,10.10.1.103,ACME\svc_web,10,2026-02-19T16:28:42.907Z,2026-02-19T19:28:32.631Z,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,ACME\svc_sql,2,2026-02-18T21:50:34.213Z,2026-02-19T07:20:53.104Z,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,ACME\emartinez,2,2026-02-11T09:06:27.246Z,2026-02-11T11:25:00.125Z,Windows Server 2019
|
||||
ENG-WS-004,10.10.2.104,ACME\cjohnson,2,2026-02-13T08:35:29.495Z,2026-02-13T15:52:05.734Z,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,ACME\idavis,10,2026-02-19T17:23:04.396Z,2026-02-20T00:37:16.818Z,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,ACME\admin,10,2026-02-14T03:25:34.410Z,2026-02-14T10:55:35.412Z,Windows 10 Enterprise
|
||||
LEG-WS-005,10.10.3.105,ACME\svc_sql,3,2026-02-17T17:50:11.604Z,2026-02-17T22:14:26.990Z,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,ACME\svc_web,10,2026-02-11T09:48:56.652Z,,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,ACME\bwilson,10,2026-02-10T18:48:03.885Z,2026-02-11T01:51:20.678Z,Windows 11 Enterprise
|
||||
MKT-WS-006,10.10.1.106,ACME\svc_backup,10,2026-02-13T03:05:51.107Z,2026-02-13T06:52:13.336Z,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,ACME\svc_web,3,2026-02-18T18:32:46.430Z,,Windows Server 2022
|
||||
EXEC-WS-007,10.10.2.107,ACME\jsmith,3,2026-02-20T01:44:44.694Z,,Windows Server 2019
|
||||
IT-WS-008,10.10.3.108,ACME\bwilson,10,2026-02-12T17:44:34.450Z,,Windows 10 Enterprise
|
||||
HR-WS-009,10.10.1.109,ACME\dlee,3,2026-02-12T16:59:52.610Z,2026-02-12T19:19:40.030Z,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,ACME\svc_sql,10,2026-02-19T05:07:55.057Z,2026-02-19T13:20:14.389Z,Windows 11 Enterprise
|
||||
FIN-WS-010,10.10.2.110,ACME\idavis,3,2026-02-15T00:54:53.507Z,2026-02-15T02:02:32.810Z,Windows Server 2022
|
||||
FIN-WS-010,10.10.2.110,ACME\emartinez,2,2026-02-11T17:22:16.798Z,,Windows Server 2022
|
||||
FIN-WS-010,10.10.2.110,ACME\svc_sql,2,2026-02-19T03:09:04.371Z,2026-02-19T09:08:46.020Z,Windows Server 2022
|
||||
SLS-WS-011,10.10.3.111,ACME\jsmith,10,2026-02-14T17:25:05.510Z,2026-02-14T20:21:23.416Z,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,ACME\admin,2,2026-02-20T05:47:59.301Z,2026-02-20T07:11:14.685Z,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,ACME\svc_sql,3,2026-02-19T00:44:15.031Z,,Windows Server 2019
|
||||
ENG-WS-012,10.10.1.112,ACME\jsmith,2,2026-02-16T17:08:17.109Z,,Windows 10 Enterprise
|
||||
LEG-WS-013,10.10.2.113,ACME\svc_sql,2,2026-02-13T01:36:09.002Z,,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,ACME\emartinez,2,2026-02-12T06:29:05.626Z,2026-02-12T10:13:07.627Z,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,ACME\fthompson,2,2026-02-19T16:37:13.912Z,2026-02-19T23:51:58.182Z,Windows 11 Enterprise
|
||||
MKT-WS-014,10.10.3.114,ACME\jsmith,2,2026-02-12T10:03:32.551Z,2026-02-12T15:02:40.993Z,Windows Server 2022
|
||||
EXEC-WS-015,10.10.1.115,ACME\bwilson,2,2026-02-11T17:51:50.902Z,,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,ACME\idavis,2,2026-02-19T18:27:36.117Z,,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,ACME\emartinez,3,2026-02-18T13:18:33.046Z,2026-02-18T18:49:58.167Z,Windows Server 2019
|
||||
IT-WS-016,10.10.2.116,ACME\svc_web,10,2026-02-20T00:10:52.698Z,2026-02-20T04:34:07.792Z,Windows 10 Enterprise
|
||||
IT-WS-016,10.10.2.116,ACME\svc_backup,10,2026-02-17T17:42:51.219Z,2026-02-18T01:45:38.050Z,Windows 10 Enterprise
|
||||
IT-WS-016,10.10.2.116,ACME\emartinez,2,2026-02-13T13:58:01.715Z,2026-02-13T20:07:49.098Z,Windows 10 Enterprise
|
||||
HR-WS-017,10.10.3.117,ACME\hbrown,10,2026-02-16T05:42:16.836Z,2026-02-16T13:26:56.569Z,Windows 11 Enterprise
|
||||
FIN-WS-018,10.10.1.118,ACME\svc_web,10,2026-02-17T04:02:44.098Z,2026-02-17T06:47:30.956Z,Windows Server 2022
|
||||
SLS-WS-019,10.10.2.119,ACME\dlee,2,2026-02-16T09:29:29.147Z,2026-02-16T13:51:01.526Z,Windows Server 2019
|
||||
SLS-WS-019,10.10.2.119,ACME\svc_backup,10,2026-02-15T15:19:14.774Z,2026-02-16T00:49:54.396Z,Windows Server 2019
|
||||
ENG-WS-020,10.10.3.120,ACME\bwilson,3,2026-02-11T20:14:59.199Z,2026-02-11T23:16:55.830Z,Windows 10 Enterprise
|
||||
ENG-WS-020,10.10.3.120,ACME\dlee,10,2026-02-16T22:35:18.680Z,,Windows 10 Enterprise
|
||||
ENG-WS-020,10.10.3.120,ACME\svc_sql,10,2026-02-18T17:04:59.041Z,2026-02-18T22:34:22.842Z,Windows 10 Enterprise
|
||||
LEG-WS-021,10.10.1.121,ACME\fthompson,10,2026-02-18T10:34:32.151Z,2026-02-18T14:11:49.252Z,Windows 11 Enterprise
|
||||
LEG-WS-021,10.10.1.121,ACME\svc_backup,2,2026-02-13T01:37:08.345Z,2026-02-13T06:31:18.977Z,Windows 11 Enterprise
|
||||
LEG-WS-021,10.10.1.121,ACME\idavis,2,2026-02-18T01:44:04.261Z,,Windows 11 Enterprise
|
||||
MKT-WS-022,10.10.2.122,ACME\svc_backup,2,2026-02-10T21:51:50.126Z,,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,ACME\svc_sql,10,2026-02-16T08:50:03.777Z,,Windows Server 2022
|
||||
EXEC-WS-023,10.10.3.123,ACME\bwilson,10,2026-02-14T22:10:06.595Z,2026-02-14T23:45:48.592Z,Windows Server 2019
|
||||
EXEC-WS-023,10.10.3.123,ACME\svc_sql,2,2026-02-11T17:04:35.135Z,2026-02-11T20:05:01.609Z,Windows Server 2019
|
||||
EXEC-WS-023,10.10.3.123,ACME\svc_backup,3,2026-02-19T22:57:28.638Z,2026-02-20T06:20:22.890Z,Windows Server 2019
|
||||
IT-WS-024,10.10.1.124,ACME\svc_web,3,2026-02-12T11:59:59.061Z,2026-02-12T12:35:57.980Z,Windows 10 Enterprise
|
||||
HR-WS-025,10.10.2.125,ACME\svc_sql,3,2026-02-15T05:08:57.237Z,,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,ACME\idavis,10,2026-02-20T08:38:06.286Z,2026-02-20T11:25:35.220Z,Windows 11 Enterprise
|
||||
FIN-WS-026,10.10.3.126,ACME\idavis,10,2026-02-17T21:12:27.358Z,2026-02-18T01:27:41.010Z,Windows Server 2022
|
||||
FIN-WS-026,10.10.3.126,ACME\jsmith,10,2026-02-17T18:36:19.617Z,2026-02-18T04:06:32.766Z,Windows Server 2022
|
||||
FIN-WS-026,10.10.3.126,ACME\agarcia,2,2026-02-18T20:11:00.202Z,2026-02-19T04:07:24.421Z,Windows Server 2022
|
||||
SLS-WS-027,10.10.1.127,ACME\cjohnson,3,2026-02-16T01:15:04.595Z,2026-02-16T08:14:59.728Z,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,ACME\svc_web,3,2026-02-11T04:57:49.338Z,2026-02-11T12:20:08.092Z,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,ACME\jsmith,2,2026-02-14T22:36:10.872Z,2026-02-15T04:09:32.820Z,Windows Server 2019
|
||||
ENG-WS-028,10.10.2.128,ACME\emartinez,2,2026-02-10T10:43:30.295Z,2026-02-10T12:21:18.954Z,Windows 10 Enterprise
|
||||
ENG-WS-028,10.10.2.128,ACME\agarcia,10,2026-02-17T11:10:18.102Z,2026-02-17T16:02:50.839Z,Windows 10 Enterprise
|
||||
LEG-WS-029,10.10.3.129,ACME\emartinez,10,2026-02-14T10:49:11.753Z,,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,ACME\gwhite,10,2026-02-20T01:41:09.184Z,2026-02-20T08:35:51.265Z,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,ACME\svc_backup,3,2026-02-12T04:17:16.386Z,2026-02-12T12:39:20.882Z,Windows 11 Enterprise
|
||||
MKT-WS-030,10.10.1.130,ACME\dlee,10,2026-02-19T09:56:10.855Z,2026-02-19T19:48:24.356Z,Windows Server 2022
|
||||
MKT-WS-030,10.10.1.130,ACME\agarcia,10,2026-02-17T17:21:55.036Z,2026-02-17T22:09:46.832Z,Windows Server 2022
|
||||
EXEC-WS-031,10.10.2.131,ACME\admin,10,2026-02-10T16:44:36.145Z,,Windows Server 2019
|
||||
IT-WS-032,10.10.3.132,ACME\cjohnson,10,2026-02-12T21:01:40.843Z,2026-02-13T00:13:30.847Z,Windows 10 Enterprise
|
||||
IT-WS-032,10.10.3.132,ACME\svc_sql,3,2026-02-10T08:49:32.659Z,2026-02-10T10:39:13.588Z,Windows 10 Enterprise
|
||||
IT-WS-032,10.10.3.132,ACME\idavis,2,2026-02-20T11:31:40.794Z,2026-02-20T16:48:16.067Z,Windows 10 Enterprise
|
||||
HR-WS-033,10.10.1.133,ACME\agarcia,3,2026-02-12T11:07:06.421Z,2026-02-12T20:44:06.116Z,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,ACME\idavis,2,2026-02-12T21:15:41.371Z,2026-02-13T03:37:44.480Z,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,ACME\cjohnson,2,2026-02-10T13:57:00.717Z,2026-02-10T20:39:38.037Z,Windows 11 Enterprise
|
||||
FIN-WS-034,10.10.2.134,ACME\bwilson,3,2026-02-17T18:03:46.436Z,2026-02-18T03:19:43.816Z,Windows Server 2022
|
||||
SLS-WS-035,10.10.3.135,ACME\svc_sql,10,2026-02-15T12:57:07.282Z,2026-02-15T19:04:37.869Z,Windows Server 2019
|
||||
ENG-WS-036,10.10.1.136,ACME\svc_web,10,2026-02-18T15:40:50.583Z,2026-02-18T18:05:35.800Z,Windows 10 Enterprise
|
||||
LEG-WS-037,10.10.2.137,ACME\bwilson,10,2026-02-16T02:10:26.988Z,2026-02-16T06:56:01.127Z,Windows 11 Enterprise
|
||||
LEG-WS-037,10.10.2.137,ACME\jsmith,2,2026-02-17T10:55:10.623Z,2026-02-17T17:06:13.738Z,Windows 11 Enterprise
|
||||
LEG-WS-037,10.10.2.137,ACME\admin,3,2026-02-15T08:12:50.391Z,2026-02-15T16:48:40.322Z,Windows 11 Enterprise
|
||||
MKT-WS-038,10.10.3.138,ACME\admin,10,2026-02-14T14:22:36.434Z,2026-02-14T20:33:17.463Z,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,ACME\idavis,2,2026-02-10T12:33:19.862Z,,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,ACME\cjohnson,3,2026-02-14T03:03:39.346Z,,Windows Server 2022
|
||||
EXEC-WS-039,10.10.1.139,ACME\emartinez,3,2026-02-12T15:26:12.740Z,2026-02-12T18:23:31.810Z,Windows Server 2019
|
||||
IT-WS-040,10.10.2.140,ACME\idavis,2,2026-02-12T15:39:47.637Z,2026-02-12T22:11:33.746Z,Windows 10 Enterprise
|
||||
IT-WS-040,10.10.2.140,ACME\fthompson,2,2026-02-13T10:36:38.122Z,,Windows 10 Enterprise
|
||||
HR-WS-041,10.10.3.141,ACME\dlee,3,2026-02-15T16:45:18.354Z,,Windows 11 Enterprise
|
||||
FIN-WS-042,10.10.1.142,ACME\svc_backup,10,2026-02-13T01:05:29.949Z,2026-02-13T08:45:38.547Z,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,ACME\gwhite,10,2026-02-12T05:08:08.376Z,2026-02-12T14:57:07.908Z,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,ACME\bwilson,2,2026-02-11T09:12:22.768Z,2026-02-11T18:03:32.327Z,Windows Server 2022
|
||||
SLS-WS-043,10.10.2.143,ACME\emartinez,10,2026-02-10T08:11:58.189Z,2026-02-10T14:21:34.307Z,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,ACME\svc_sql,10,2026-02-14T03:50:49.336Z,2026-02-14T12:06:10.084Z,Windows Server 2019
|
||||
ENG-WS-044,10.10.3.144,ACME\fthompson,3,2026-02-10T21:26:43.757Z,,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,ACME\hbrown,2,2026-02-15T13:43:23.944Z,2026-02-15T23:21:05.115Z,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,ACME\idavis,2,2026-02-11T21:26:42.687Z,2026-02-12T03:15:22.121Z,Windows 10 Enterprise
|
||||
LEG-WS-045,10.10.1.145,ACME\svc_backup,10,2026-02-14T13:34:41.010Z,2026-02-14T19:05:53.025Z,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,ACME\agarcia,10,2026-02-10T15:47:07.953Z,2026-02-11T00:44:00.362Z,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,ACME\bwilson,10,2026-02-15T20:33:32.011Z,2026-02-16T04:02:03.695Z,Windows 11 Enterprise
|
||||
MKT-WS-046,10.10.2.146,ACME\emartinez,3,2026-02-12T03:40:13.508Z,2026-02-12T08:12:36.966Z,Windows Server 2022
|
||||
EXEC-WS-047,10.10.3.147,ACME\svc_web,2,2026-02-20T04:37:26.574Z,2026-02-20T12:36:14.841Z,Windows Server 2019
|
||||
EXEC-WS-047,10.10.3.147,ACME\cjohnson,2,2026-02-17T03:09:07.678Z,2026-02-17T05:11:23.506Z,Windows Server 2019
|
||||
IT-WS-048,10.10.1.148,ACME\svc_backup,2,2026-02-11T18:49:32.007Z,,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,ACME\admin,10,2026-02-19T13:38:11.426Z,,Windows 10 Enterprise
|
||||
HR-WS-049,10.10.2.149,ACME\idavis,2,2026-02-13T09:27:02.147Z,2026-02-13T14:09:17.279Z,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,ACME\cjohnson,10,2026-02-16T14:31:31.829Z,2026-02-16T20:21:16.254Z,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,ACME\svc_web,10,2026-02-11T04:49:41.763Z,2026-02-11T10:53:32.643Z,Windows 11 Enterprise
|
||||
FIN-WS-050,10.10.3.150,ACME\svc_sql,10,2026-02-16T13:23:33.444Z,2026-02-16T15:30:49.957Z,Windows Server 2022
|
||||
FIN-WS-050,10.10.3.150,ACME\svc_web,10,2026-02-13T09:58:42.075Z,2026-02-13T16:29:30.095Z,Windows Server 2022
|
||||
SLS-WS-051,10.10.1.151,ACME\agarcia,10,2026-02-18T07:55:41.992Z,2026-02-18T10:54:03.481Z,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,ACME\admin,2,2026-02-15T16:03:29.360Z,2026-02-16T00:17:55.642Z,Windows Server 2019
|
||||
ENG-WS-052,10.10.2.152,ACME\svc_web,10,2026-02-18T12:28:09.927Z,2026-02-18T16:46:29.828Z,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,ACME\idavis,3,2026-02-18T23:31:19.526Z,2026-02-19T08:54:17.009Z,Windows 10 Enterprise
|
||||
LEG-WS-053,10.10.3.153,ACME\gwhite,2,2026-02-16T21:58:16.692Z,,Windows 11 Enterprise
|
||||
MKT-WS-054,10.10.1.154,ACME\fthompson,10,2026-02-16T02:40:07.132Z,2026-02-16T06:05:45.953Z,Windows Server 2022
|
||||
EXEC-WS-055,10.10.2.155,ACME\svc_web,3,2026-02-14T12:56:53.489Z,,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,ACME\svc_sql,2,2026-02-16T19:46:18.314Z,2026-02-17T03:37:45.216Z,Windows Server 2019
|
||||
IT-WS-056,10.10.3.156,ACME\agarcia,10,2026-02-13T12:11:31.170Z,2026-02-13T20:23:26.255Z,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,ACME\bwilson,2,2026-02-18T07:47:28.631Z,2026-02-18T12:43:49.215Z,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,ACME\fthompson,10,2026-02-15T10:34:59.328Z,,Windows 10 Enterprise
|
||||
HR-WS-057,10.10.1.157,ACME\emartinez,10,2026-02-12T20:30:10.337Z,,Windows 11 Enterprise
|
||||
HR-WS-057,10.10.1.157,ACME\fthompson,10,2026-02-17T23:44:46.543Z,2026-02-18T08:06:20.732Z,Windows 11 Enterprise
|
||||
FIN-WS-058,10.10.2.158,ACME\admin,10,2026-02-14T22:49:09.181Z,,Windows Server 2022
|
||||
SLS-WS-059,10.10.3.159,ACME\agarcia,2,2026-02-17T03:15:51.656Z,,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,ACME\fthompson,10,2026-02-18T17:16:46.768Z,2026-02-18T21:18:32.972Z,Windows Server 2019
|
||||
ENG-WS-060,10.10.1.160,ACME\dlee,10,2026-02-11T01:43:00.260Z,,Windows 10 Enterprise
|
||||
LEG-WS-061,10.10.2.161,ACME\gwhite,2,2026-02-13T11:12:03.130Z,,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,ACME\fthompson,10,2026-02-16T23:31:29.658Z,2026-02-17T01:57:47.139Z,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,ACME\emartinez,2,2026-02-11T05:57:03.436Z,2026-02-11T06:42:29.220Z,Windows 11 Enterprise
|
||||
MKT-WS-062,10.10.3.162,ACME\svc_sql,2,2026-02-20T01:38:41.003Z,,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,ACME\agarcia,2,2026-02-18T12:14:12.295Z,2026-02-18T13:22:44.877Z,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,ACME\jsmith,3,2026-02-11T05:12:34.424Z,,Windows Server 2022
|
||||
EXEC-WS-063,10.10.1.163,ACME\admin,10,2026-02-15T01:20:24.037Z,2026-02-15T08:29:33.232Z,Windows Server 2019
|
||||
IT-WS-064,10.10.2.164,ACME\emartinez,2,2026-02-17T11:38:09.952Z,2026-02-17T21:34:46.199Z,Windows 10 Enterprise
|
||||
HR-WS-065,10.10.3.165,ACME\bwilson,2,2026-02-12T07:12:16.922Z,,Windows 11 Enterprise
|
||||
HR-WS-065,10.10.3.165,ACME\svc_backup,10,2026-02-11T00:56:04.540Z,2026-02-11T08:01:21.095Z,Windows 11 Enterprise
|
||||
FIN-WS-066,10.10.1.166,ACME\dlee,10,2026-02-19T05:57:37.028Z,2026-02-19T11:17:42.241Z,Windows Server 2022
|
||||
SLS-WS-067,10.10.2.167,ACME\svc_backup,2,2026-02-15T12:30:46.626Z,,Windows Server 2019
|
||||
ENG-WS-068,10.10.3.168,ACME\admin,10,2026-02-18T12:37:02.663Z,,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,ACME\cjohnson,10,2026-02-14T14:25:49.436Z,,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,ACME\dlee,10,2026-02-12T04:36:57.506Z,2026-02-12T05:41:35.348Z,Windows 10 Enterprise
|
||||
LEG-WS-069,10.10.1.169,ACME\fthompson,2,2026-02-16T20:07:50.289Z,2026-02-17T04:27:27.454Z,Windows 11 Enterprise
|
||||
MKT-WS-070,10.10.2.170,ACME\dlee,10,2026-02-14T11:37:16.104Z,2026-02-14T13:22:16.645Z,Windows Server 2022
|
||||
MKT-WS-070,10.10.2.170,ACME\svc_web,3,2026-02-10T08:22:31.467Z,2026-02-10T10:17:31.541Z,Windows Server 2022
|
||||
MKT-WS-070,10.10.2.170,ACME\svc_sql,3,2026-02-18T04:28:19.510Z,2026-02-18T11:48:49.289Z,Windows Server 2022
|
||||
EXEC-WS-071,10.10.3.171,ACME\admin,2,2026-02-14T21:25:07.016Z,2026-02-15T01:48:57.362Z,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,ACME\svc_backup,10,2026-02-12T20:12:27.125Z,2026-02-12T23:20:08.269Z,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,ACME\cjohnson,10,2026-02-16T09:32:31.958Z,2026-02-16T10:29:12.449Z,Windows Server 2019
|
||||
IT-WS-072,10.10.1.172,ACME\idavis,2,2026-02-19T15:23:35.302Z,2026-02-20T00:57:36.100Z,Windows 10 Enterprise
|
||||
HR-WS-073,10.10.2.173,ACME\emartinez,2,2026-02-14T09:20:44.855Z,2026-02-14T18:55:52.875Z,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,ACME\hbrown,2,2026-02-13T11:47:22.510Z,2026-02-13T13:44:56.845Z,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,ACME\cjohnson,3,2026-02-14T16:58:28.455Z,2026-02-14T22:43:13.054Z,Windows 11 Enterprise
|
||||
FIN-WS-074,10.10.3.174,ACME\dlee,10,2026-02-16T18:29:13.839Z,,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,ACME\admin,10,2026-02-19T12:25:04.093Z,2026-02-19T15:25:32.007Z,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,ACME\gwhite,10,2026-02-13T17:34:03.583Z,,Windows Server 2022
|
||||
SLS-WS-075,10.10.1.175,ACME\admin,10,2026-02-16T15:23:53.945Z,2026-02-16T16:04:05.964Z,Windows Server 2019
|
||||
SLS-WS-075,10.10.1.175,ACME\svc_sql,2,2026-02-14T19:49:21.691Z,2026-02-15T04:31:54.404Z,Windows Server 2019
|
||||
DC-01,10.10.1.10,ACME\admin,2,2026-02-15T17:23:38.033Z,2026-02-15T18:02:54.817Z,Windows Server 2022
|
||||
DC-02,10.10.2.10,ACME\admin,10,2026-02-12T03:04:20.793Z,2026-02-12T07:34:27.380Z,Windows Server 2022
|
||||
DC-02,10.10.2.10,ACME\gwhite,2,2026-02-17T22:41:13.350Z,,Windows Server 2022
|
||||
DC-02,10.10.2.10,ACME\dlee,10,2026-02-14T17:29:00.267Z,,Windows Server 2022
|
||||
FILE-01,10.10.1.11,ACME\bwilson,3,2026-02-11T21:18:31.543Z,,Windows Server 2019
|
||||
FILE-01,10.10.1.11,ACME\hbrown,10,2026-02-16T00:53:59.083Z,2026-02-16T03:20:43.181Z,Windows Server 2019
|
||||
FILE-01,10.10.1.11,ACME\emartinez,3,2026-02-18T20:53:55.592Z,2026-02-19T05:59:50.555Z,Windows Server 2019
|
||||
EXCH-01,10.10.1.12,ACME\bwilson,10,2026-02-12T16:54:40.664Z,,Windows Server 2022
|
||||
EXCH-01,10.10.1.12,ACME\dlee,10,2026-02-13T00:45:40.170Z,,Windows Server 2022
|
||||
EXCH-01,10.10.1.12,ACME\svc_sql,2,2026-02-19T12:13:54.245Z,2026-02-19T18:00:56.147Z,Windows Server 2022
|
||||
WEB-01,10.10.3.10,ACME\admin,2,2026-02-11T04:22:10.529Z,2026-02-11T10:31:15.005Z,Windows Server 2022
|
||||
WEB-01,10.10.3.10,ACME\hbrown,3,2026-02-20T02:24:15.106Z,2026-02-20T04:27:46.695Z,Windows Server 2022
|
||||
WEB-01,10.10.3.10,ACME\cjohnson,2,2026-02-11T15:43:33.584Z,2026-02-11T19:05:11.076Z,Windows Server 2022
|
||||
SQL-01,10.10.2.11,ACME\agarcia,2,2026-02-16T14:25:46.694Z,2026-02-16T15:21:39.280Z,Windows Server 2019
|
||||
SQL-01,10.10.2.11,ACME\svc_backup,2,2026-02-11T07:27:04.230Z,2026-02-11T09:20:41.606Z,Windows Server 2019
|
||||
PROXY-01,10.10.1.13,ACME\cjohnson,10,2026-02-17T00:47:34.831Z,2026-02-17T07:52:30.535Z,Windows Server 2022
|
||||
|
411
backend/tests/test_csvs/06_scheduled_tasks.csv
Normal file
411
backend/tests/test_csvs/06_scheduled_tasks.csv
Normal file
@@ -0,0 +1,411 @@
|
||||
Hostname,IP,TaskName,CommandLine,Enabled,LastRunTime,NextRunTime,Username
|
||||
HR-WS-001,10.10.2.101,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-11T04:10:18.272Z,2026-02-13T00:59:27.083Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-001,10.10.2.101,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-18T22:21:06.535Z,2026-02-13T00:20:19.721Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-001,10.10.2.101,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T22:34:59.678Z,2026-02-10T14:58:18.353Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-001,10.10.2.101,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-19T10:19:22.767Z,2026-02-20T15:37:57.928Z,ACME\svc_backup
|
||||
HR-WS-001,10.10.2.101,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-18T16:32:05.355Z,2026-02-18T09:04:04.511Z,ACME\svc_backup
|
||||
FIN-WS-002,10.10.3.102,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T19:08:35.756Z,2026-02-17T04:24:25.316Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-002,10.10.3.102,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-12T10:09:36.081Z,2026-02-12T14:35:40.437Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-002,10.10.3.102,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-15T16:46:39.201Z,2026-02-18T17:27:26.085Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-002,10.10.3.102,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T19:09:52.759Z,2026-02-18T11:49:21.126Z,ACME\svc_backup
|
||||
FIN-WS-002,10.10.3.102,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-19T01:57:38.377Z,2026-02-19T03:39:09.043Z,ACME\svc_backup
|
||||
SLS-WS-003,10.10.1.103,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T23:33:16.784Z,2026-02-18T03:56:24.145Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-003,10.10.1.103,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-14T12:02:21.885Z,2026-02-10T09:06:28.155Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-003,10.10.1.103,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-10T08:29:32.180Z,2026-02-20T05:43:38.079Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-003,10.10.1.103,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-12T20:47:27.743Z,2026-02-14T20:40:38.686Z,ACME\svc_backup
|
||||
SLS-WS-003,10.10.1.103,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-15T08:44:46.616Z,2026-02-14T02:51:26.262Z,ACME\svc_backup
|
||||
ENG-WS-004,10.10.2.104,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T09:23:23.347Z,2026-02-14T22:26:28.830Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-004,10.10.2.104,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-20T06:44:32.640Z,2026-02-17T21:47:53.810Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-004,10.10.2.104,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-15T04:57:06.522Z,2026-02-12T18:35:33.511Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-004,10.10.2.104,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T19:05:56.454Z,2026-02-12T15:35:44.582Z,ACME\svc_backup
|
||||
ENG-WS-004,10.10.2.104,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T12:42:15.302Z,2026-02-20T10:33:44.912Z,ACME\svc_backup
|
||||
LEG-WS-005,10.10.3.105,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T06:05:12.613Z,2026-02-15T21:32:29.512Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-005,10.10.3.105,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-18T11:19:55.513Z,2026-02-10T22:00:16.747Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-005,10.10.3.105,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-16T12:32:08.627Z,2026-02-13T08:21:40.415Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-005,10.10.3.105,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-14T06:57:14.139Z,2026-02-11T10:11:17.762Z,ACME\svc_backup
|
||||
LEG-WS-005,10.10.3.105,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T03:50:01.070Z,2026-02-18T00:35:18.228Z,ACME\svc_backup
|
||||
MKT-WS-006,10.10.1.106,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-11T22:20:50.111Z,2026-02-17T09:07:59.275Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-006,10.10.1.106,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T03:21:15.355Z,2026-02-16T21:59:46.067Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-006,10.10.1.106,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T05:57:57.374Z,2026-02-10T16:59:40.813Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-006,10.10.1.106,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-11T23:34:05.389Z,2026-02-13T01:32:43.835Z,ACME\svc_backup
|
||||
MKT-WS-006,10.10.1.106,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-18T04:35:33.516Z,2026-02-13T17:55:50.780Z,ACME\svc_backup
|
||||
EXEC-WS-007,10.10.2.107,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T09:31:08.738Z,2026-02-17T19:09:26.442Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-007,10.10.2.107,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-11T21:48:25.002Z,2026-02-11T03:43:03.357Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-007,10.10.2.107,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-10T23:54:37.709Z,2026-02-14T23:33:07.222Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-007,10.10.2.107,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T19:14:09.341Z,2026-02-14T09:51:49.598Z,ACME\svc_backup
|
||||
EXEC-WS-007,10.10.2.107,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-19T10:07:28.683Z,2026-02-15T07:58:45.104Z,ACME\svc_backup
|
||||
IT-WS-008,10.10.3.108,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-11T11:58:13.097Z,2026-02-19T14:28:46.034Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-008,10.10.3.108,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-17T18:52:05.470Z,2026-02-19T08:37:29.557Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-008,10.10.3.108,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T12:54:47.353Z,2026-02-18T13:22:38.075Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-008,10.10.3.108,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T12:22:20.956Z,2026-02-15T10:44:19.542Z,ACME\svc_backup
|
||||
IT-WS-008,10.10.3.108,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-17T15:14:52.999Z,2026-02-15T10:03:00.756Z,ACME\svc_backup
|
||||
HR-WS-009,10.10.1.109,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-15T17:50:29.509Z,2026-02-19T02:51:18.037Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-009,10.10.1.109,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T18:45:37.946Z,2026-02-18T18:31:24.942Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-009,10.10.1.109,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-20T14:02:14.569Z,2026-02-16T07:54:05.576Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-009,10.10.1.109,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-12T14:46:40.034Z,2026-02-17T09:05:45.968Z,ACME\svc_backup
|
||||
HR-WS-009,10.10.1.109,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-20T12:34:17.719Z,2026-02-10T10:25:36.528Z,ACME\svc_backup
|
||||
FIN-WS-010,10.10.2.110,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T16:05:20.284Z,2026-02-11T14:09:53.006Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-010,10.10.2.110,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-18T17:20:38.118Z,2026-02-11T14:06:07.250Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-010,10.10.2.110,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T16:42:52.183Z,2026-02-18T13:30:07.185Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-010,10.10.2.110,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T16:08:48.332Z,2026-02-12T08:59:35.678Z,ACME\svc_backup
|
||||
FIN-WS-010,10.10.2.110,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-10T21:41:35.587Z,2026-02-19T02:02:26.909Z,ACME\svc_backup
|
||||
SLS-WS-011,10.10.3.111,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T07:35:36.579Z,2026-02-14T04:17:39.468Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-011,10.10.3.111,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-11T10:21:27.809Z,2026-02-19T22:23:50.559Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-011,10.10.3.111,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-17T23:54:51.119Z,2026-02-11T11:19:59.085Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-011,10.10.3.111,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T14:59:56.507Z,2026-02-10T15:12:34.534Z,ACME\svc_backup
|
||||
SLS-WS-011,10.10.3.111,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T01:42:27.441Z,2026-02-15T16:42:53.961Z,ACME\svc_backup
|
||||
ENG-WS-012,10.10.1.112,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T08:47:19.597Z,2026-02-15T23:16:44.221Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-012,10.10.1.112,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-16T05:17:16.467Z,2026-02-20T15:14:36.400Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-012,10.10.1.112,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-12T17:04:07.300Z,2026-02-17T13:33:01.444Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-012,10.10.1.112,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-19T10:41:22.404Z,2026-02-15T08:14:38.725Z,ACME\svc_backup
|
||||
ENG-WS-012,10.10.1.112,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T19:29:02.351Z,2026-02-11T19:48:45.196Z,ACME\svc_backup
|
||||
LEG-WS-013,10.10.2.113,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T12:38:12.330Z,2026-02-17T15:08:18.153Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-013,10.10.2.113,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-12T12:39:57.944Z,2026-02-16T08:29:18.173Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-013,10.10.2.113,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T16:53:14.600Z,2026-02-10T15:48:25.569Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-013,10.10.2.113,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-18T23:37:15.766Z,2026-02-16T04:26:54.647Z,ACME\svc_backup
|
||||
LEG-WS-013,10.10.2.113,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-19T18:56:57.978Z,2026-02-18T08:05:41.707Z,ACME\svc_backup
|
||||
MKT-WS-014,10.10.3.114,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T04:54:01.657Z,2026-02-16T08:42:00.134Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-014,10.10.3.114,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-16T00:19:53.914Z,2026-02-15T07:55:08.380Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-014,10.10.3.114,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-17T02:15:29.456Z,2026-02-17T14:37:46.580Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-014,10.10.3.114,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-19T03:41:01.814Z,2026-02-18T20:49:02.270Z,ACME\svc_backup
|
||||
MKT-WS-014,10.10.3.114,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-18T22:20:31.364Z,2026-02-16T10:39:04.357Z,ACME\svc_backup
|
||||
EXEC-WS-015,10.10.1.115,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T00:25:37.310Z,2026-02-11T04:27:50.639Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-015,10.10.1.115,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T21:45:43.509Z,2026-02-17T07:13:31.528Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-015,10.10.1.115,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-18T10:33:00.550Z,2026-02-12T03:49:17.618Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-015,10.10.1.115,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-19T13:57:59.293Z,2026-02-12T17:08:19.461Z,ACME\svc_backup
|
||||
EXEC-WS-015,10.10.1.115,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-20T15:58:21.276Z,2026-02-18T02:43:23.938Z,ACME\svc_backup
|
||||
IT-WS-016,10.10.2.116,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-11T17:53:34.407Z,2026-02-15T13:47:25.202Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-016,10.10.2.116,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-19T05:34:08.201Z,2026-02-10T12:07:30.178Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-016,10.10.2.116,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T00:09:46.336Z,2026-02-15T06:50:54.924Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-016,10.10.2.116,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T09:11:55.347Z,2026-02-19T18:34:52.818Z,ACME\svc_backup
|
||||
IT-WS-016,10.10.2.116,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-11T23:33:28.562Z,2026-02-17T11:48:41.377Z,ACME\svc_backup
|
||||
HR-WS-017,10.10.3.117,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T09:47:17.619Z,2026-02-20T07:55:22.028Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-017,10.10.3.117,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T20:20:44.882Z,2026-02-19T08:19:13.236Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-017,10.10.3.117,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-12T15:24:05.664Z,2026-02-11T00:56:49.490Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-017,10.10.3.117,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-14T07:55:36.757Z,2026-02-19T07:54:44.258Z,ACME\svc_backup
|
||||
HR-WS-017,10.10.3.117,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T16:29:13.283Z,2026-02-14T21:46:54.021Z,ACME\svc_backup
|
||||
FIN-WS-018,10.10.1.118,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T14:39:21.986Z,2026-02-14T21:47:34.203Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-018,10.10.1.118,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-14T22:11:15.193Z,2026-02-11T11:23:59.541Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-018,10.10.1.118,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T13:50:52.916Z,2026-02-14T00:08:04.372Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-018,10.10.1.118,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T06:09:38.641Z,2026-02-19T21:38:06.213Z,ACME\svc_backup
|
||||
FIN-WS-018,10.10.1.118,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T23:36:15.163Z,2026-02-14T22:05:30.950Z,ACME\svc_backup
|
||||
SLS-WS-019,10.10.2.119,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T17:26:19.317Z,2026-02-18T14:05:54.158Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-019,10.10.2.119,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T00:53:27.139Z,2026-02-17T01:41:01.159Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-019,10.10.2.119,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-18T11:19:23.835Z,2026-02-16T12:51:56.274Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-019,10.10.2.119,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-11T07:27:43.891Z,2026-02-17T13:45:31.692Z,ACME\svc_backup
|
||||
SLS-WS-019,10.10.2.119,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-18T13:09:32.527Z,2026-02-16T17:33:43.569Z,ACME\svc_backup
|
||||
ENG-WS-020,10.10.3.120,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T06:49:14.065Z,2026-02-15T08:04:18.774Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-020,10.10.3.120,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-14T09:23:50.169Z,2026-02-10T12:51:38.083Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-020,10.10.3.120,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-18T05:01:59.602Z,2026-02-16T13:15:30.465Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-020,10.10.3.120,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-11T05:20:52.039Z,2026-02-10T11:12:43.499Z,ACME\svc_backup
|
||||
ENG-WS-020,10.10.3.120,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T08:32:00.457Z,2026-02-17T15:43:39.779Z,ACME\svc_backup
|
||||
LEG-WS-021,10.10.1.121,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-20T11:10:29.415Z,2026-02-11T13:13:41.644Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-021,10.10.1.121,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-17T23:06:43.206Z,2026-02-12T10:50:24.538Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-021,10.10.1.121,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T01:40:28.291Z,2026-02-15T22:59:54.785Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-021,10.10.1.121,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-12T11:56:38.797Z,2026-02-12T05:51:20.276Z,ACME\svc_backup
|
||||
LEG-WS-021,10.10.1.121,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-10T22:08:15.182Z,2026-02-15T16:48:06.361Z,ACME\svc_backup
|
||||
MKT-WS-022,10.10.2.122,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T17:43:14.699Z,2026-02-17T08:30:49.188Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-022,10.10.2.122,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T06:41:06.394Z,2026-02-19T10:32:28.292Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-022,10.10.2.122,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-19T10:24:37.330Z,2026-02-13T02:16:21.356Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-022,10.10.2.122,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-17T21:37:04.120Z,2026-02-13T06:53:53.583Z,ACME\svc_backup
|
||||
MKT-WS-022,10.10.2.122,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-19T20:02:44.067Z,2026-02-20T04:48:00.316Z,ACME\svc_backup
|
||||
EXEC-WS-023,10.10.3.123,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-15T17:40:24.940Z,2026-02-15T11:34:19.658Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-023,10.10.3.123,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T08:32:29.614Z,2026-02-18T15:15:55.737Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-023,10.10.3.123,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-19T22:32:49.533Z,2026-02-11T02:57:20.999Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-023,10.10.3.123,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T13:55:56.086Z,2026-02-19T23:21:07.294Z,ACME\svc_backup
|
||||
EXEC-WS-023,10.10.3.123,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-15T00:20:20.226Z,2026-02-18T08:40:38.412Z,ACME\svc_backup
|
||||
IT-WS-024,10.10.1.124,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-11T15:25:00.827Z,2026-02-10T09:26:07.179Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-024,10.10.1.124,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-11T14:09:06.733Z,2026-02-15T06:05:45.983Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-024,10.10.1.124,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-12T07:46:04.449Z,2026-02-14T05:57:31.991Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-024,10.10.1.124,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T15:17:14.219Z,2026-02-17T20:08:02.700Z,ACME\svc_backup
|
||||
IT-WS-024,10.10.1.124,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-19T19:59:37.242Z,2026-02-16T00:09:04.759Z,ACME\svc_backup
|
||||
HR-WS-025,10.10.2.125,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-16T04:55:50.389Z,2026-02-16T14:01:37.319Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-025,10.10.2.125,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T13:04:32.418Z,2026-02-11T03:10:31.981Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-025,10.10.2.125,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-20T03:38:36.810Z,2026-02-19T16:34:13.701Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-025,10.10.2.125,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T15:01:01.192Z,2026-02-19T20:36:40.015Z,ACME\svc_backup
|
||||
HR-WS-025,10.10.2.125,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T03:20:06.246Z,2026-02-15T07:33:50.496Z,ACME\svc_backup
|
||||
FIN-WS-026,10.10.3.126,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T03:14:45.670Z,2026-02-19T17:51:52.973Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-026,10.10.3.126,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T02:37:02.769Z,2026-02-13T17:09:29.023Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-026,10.10.3.126,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T15:57:32.073Z,2026-02-12T07:59:55.524Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-026,10.10.3.126,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-11T16:37:59.553Z,2026-02-20T09:54:18.072Z,ACME\svc_backup
|
||||
FIN-WS-026,10.10.3.126,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T08:39:07.969Z,2026-02-15T09:49:07.790Z,ACME\svc_backup
|
||||
SLS-WS-027,10.10.1.127,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T15:23:10.055Z,2026-02-12T05:53:57.700Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-027,10.10.1.127,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-10T15:00:56.181Z,2026-02-19T15:38:50.857Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-027,10.10.1.127,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T00:42:32.206Z,2026-02-17T14:17:13.806Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-027,10.10.1.127,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T18:46:56.374Z,2026-02-12T21:23:32.173Z,ACME\svc_backup
|
||||
SLS-WS-027,10.10.1.127,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T04:37:41.365Z,2026-02-11T01:23:31.251Z,ACME\svc_backup
|
||||
ENG-WS-028,10.10.2.128,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T13:04:58.474Z,2026-02-17T02:25:59.995Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-028,10.10.2.128,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T08:54:27.210Z,2026-02-19T20:33:58.101Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-028,10.10.2.128,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-17T04:37:46.619Z,2026-02-14T19:45:40.877Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-028,10.10.2.128,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-15T16:16:04.921Z,2026-02-10T14:30:04.621Z,ACME\svc_backup
|
||||
ENG-WS-028,10.10.2.128,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T10:32:54.762Z,2026-02-16T13:11:05.730Z,ACME\svc_backup
|
||||
LEG-WS-029,10.10.3.129,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-10T20:33:02.827Z,2026-02-16T16:21:00.588Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-029,10.10.3.129,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-13T23:34:43.565Z,2026-02-12T13:16:47.250Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-029,10.10.3.129,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-19T13:38:02.407Z,2026-02-17T10:33:17.759Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-029,10.10.3.129,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T20:36:41.924Z,2026-02-13T11:46:06.808Z,ACME\svc_backup
|
||||
LEG-WS-029,10.10.3.129,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-17T18:14:48.691Z,2026-02-18T00:04:12.553Z,ACME\svc_backup
|
||||
MKT-WS-030,10.10.1.130,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-16T04:50:25.242Z,2026-02-19T06:32:03.303Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-030,10.10.1.130,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-16T03:09:11.888Z,2026-02-18T19:17:17.312Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-030,10.10.1.130,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T19:54:43.760Z,2026-02-10T08:42:57.840Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-030,10.10.1.130,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T15:58:22.109Z,2026-02-18T03:19:40.560Z,ACME\svc_backup
|
||||
MKT-WS-030,10.10.1.130,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T22:26:04.406Z,2026-02-15T16:12:35.508Z,ACME\svc_backup
|
||||
EXEC-WS-031,10.10.2.131,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T18:39:03.864Z,2026-02-13T01:35:35.660Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-031,10.10.2.131,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-20T02:01:54.852Z,2026-02-15T22:53:31.476Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-031,10.10.2.131,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T22:27:22.763Z,2026-02-19T20:20:26.276Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-031,10.10.2.131,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-17T13:30:08.797Z,2026-02-10T21:37:36.455Z,ACME\svc_backup
|
||||
EXEC-WS-031,10.10.2.131,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-10T19:45:08.117Z,2026-02-15T03:26:58.890Z,ACME\svc_backup
|
||||
IT-WS-032,10.10.3.132,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T01:11:58.620Z,2026-02-17T16:57:29.329Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-032,10.10.3.132,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-12T01:08:52.343Z,2026-02-19T07:55:59.921Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-032,10.10.3.132,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-15T06:08:56.865Z,2026-02-17T22:09:43.378Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-032,10.10.3.132,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T19:49:42.684Z,2026-02-19T19:18:30.053Z,ACME\svc_backup
|
||||
IT-WS-032,10.10.3.132,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T18:14:57.150Z,2026-02-19T15:36:07.924Z,ACME\svc_backup
|
||||
HR-WS-033,10.10.1.133,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T05:31:20.367Z,2026-02-19T13:32:04.721Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-033,10.10.1.133,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-20T07:41:32.969Z,2026-02-12T02:11:07.863Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-033,10.10.1.133,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-19T12:03:45.202Z,2026-02-17T09:21:44.329Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-033,10.10.1.133,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T00:18:58.723Z,2026-02-16T20:17:56.784Z,ACME\svc_backup
|
||||
HR-WS-033,10.10.1.133,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-17T10:14:16.140Z,2026-02-15T01:13:59.702Z,ACME\svc_backup
|
||||
FIN-WS-034,10.10.2.134,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T00:27:55.308Z,2026-02-13T18:34:21.414Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-034,10.10.2.134,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-15T05:21:12.636Z,2026-02-14T22:04:37.191Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-034,10.10.2.134,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T18:41:00.839Z,2026-02-14T22:25:57.601Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-034,10.10.2.134,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-15T18:02:25.400Z,2026-02-16T04:53:02.671Z,ACME\svc_backup
|
||||
FIN-WS-034,10.10.2.134,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-13T15:50:06.949Z,2026-02-11T04:07:22.042Z,ACME\svc_backup
|
||||
SLS-WS-035,10.10.3.135,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T23:52:06.120Z,2026-02-14T12:09:55.914Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-035,10.10.3.135,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-14T13:05:06.701Z,2026-02-15T08:42:28.508Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-035,10.10.3.135,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-10T11:15:21.002Z,2026-02-17T13:37:59.232Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-035,10.10.3.135,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T02:44:47.045Z,2026-02-15T04:41:10.501Z,ACME\svc_backup
|
||||
SLS-WS-035,10.10.3.135,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T02:27:25.262Z,2026-02-20T08:42:40.871Z,ACME\svc_backup
|
||||
ENG-WS-036,10.10.1.136,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T12:53:00.176Z,2026-02-13T04:33:20.240Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-036,10.10.1.136,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T14:22:34.288Z,2026-02-11T01:13:46.648Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-036,10.10.1.136,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T11:55:36.117Z,2026-02-10T14:20:40.804Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-036,10.10.1.136,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T12:46:25.045Z,2026-02-19T20:12:56.821Z,ACME\svc_backup
|
||||
ENG-WS-036,10.10.1.136,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T07:34:56.922Z,2026-02-10T12:49:56.644Z,ACME\svc_backup
|
||||
LEG-WS-037,10.10.2.137,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T02:51:51.978Z,2026-02-13T06:11:38.941Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-037,10.10.2.137,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-11T01:44:07.216Z,2026-02-16T23:48:04.905Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-037,10.10.2.137,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-18T17:58:07.400Z,2026-02-15T22:26:08.683Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-037,10.10.2.137,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-17T18:16:48.846Z,2026-02-10T16:29:10.995Z,ACME\svc_backup
|
||||
LEG-WS-037,10.10.2.137,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-11T17:42:26.427Z,2026-02-16T12:20:33.670Z,ACME\svc_backup
|
||||
MKT-WS-038,10.10.3.138,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T17:39:41.163Z,2026-02-11T04:30:07.114Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-038,10.10.3.138,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-18T09:19:05.003Z,2026-02-19T11:32:12.157Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-038,10.10.3.138,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-12T07:20:45.346Z,2026-02-16T19:24:42.020Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-038,10.10.3.138,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T23:31:46.676Z,2026-02-12T23:17:47.391Z,ACME\svc_backup
|
||||
MKT-WS-038,10.10.3.138,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T06:38:36.143Z,2026-02-17T05:16:43.062Z,ACME\svc_backup
|
||||
EXEC-WS-039,10.10.1.139,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T17:12:53.766Z,2026-02-17T07:38:30.430Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-039,10.10.1.139,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T09:43:58.381Z,2026-02-16T15:33:28.709Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-039,10.10.1.139,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T21:23:01.168Z,2026-02-14T17:31:20.994Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-039,10.10.1.139,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-19T12:01:04.643Z,2026-02-10T16:20:29.794Z,ACME\svc_backup
|
||||
EXEC-WS-039,10.10.1.139,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T17:39:02.933Z,2026-02-12T10:14:43.649Z,ACME\svc_backup
|
||||
IT-WS-040,10.10.2.140,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T04:52:30.083Z,2026-02-12T22:44:13.582Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-040,10.10.2.140,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-11T09:59:49.613Z,2026-02-12T04:53:13.144Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-040,10.10.2.140,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-10T20:32:09.001Z,2026-02-15T21:51:24.060Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-040,10.10.2.140,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-14T02:02:25.314Z,2026-02-13T19:45:08.607Z,ACME\svc_backup
|
||||
IT-WS-040,10.10.2.140,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T08:37:46.983Z,2026-02-15T06:11:10.277Z,ACME\svc_backup
|
||||
HR-WS-041,10.10.3.141,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-20T16:34:18.148Z,2026-02-20T01:17:01.526Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-041,10.10.3.141,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-14T18:27:49.393Z,2026-02-14T16:48:45.838Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-041,10.10.3.141,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T19:58:20.162Z,2026-02-13T18:30:27.303Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-041,10.10.3.141,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T07:35:31.485Z,2026-02-20T07:24:39.759Z,ACME\svc_backup
|
||||
HR-WS-041,10.10.3.141,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-13T07:27:28.310Z,2026-02-13T11:41:10.906Z,ACME\svc_backup
|
||||
FIN-WS-042,10.10.1.142,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-12T08:32:06.811Z,2026-02-12T05:10:22.185Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-042,10.10.1.142,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-17T00:06:44.259Z,2026-02-20T16:31:44.712Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-042,10.10.1.142,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T09:20:35.899Z,2026-02-15T03:20:39.739Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-042,10.10.1.142,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-19T22:55:01.161Z,2026-02-15T03:32:13.303Z,ACME\svc_backup
|
||||
FIN-WS-042,10.10.1.142,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-10T17:54:52.225Z,2026-02-18T08:28:27.424Z,ACME\svc_backup
|
||||
SLS-WS-043,10.10.2.143,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T00:24:25.555Z,2026-02-16T02:01:43.780Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-043,10.10.2.143,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T14:00:55.806Z,2026-02-18T13:50:11.756Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-043,10.10.2.143,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-13T06:53:39.515Z,2026-02-20T04:01:26.269Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-043,10.10.2.143,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T00:12:31.793Z,2026-02-19T05:23:06.750Z,ACME\svc_backup
|
||||
SLS-WS-043,10.10.2.143,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T13:02:39.583Z,2026-02-20T11:31:42.030Z,ACME\svc_backup
|
||||
ENG-WS-044,10.10.3.144,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T21:30:20.789Z,2026-02-13T16:26:17.537Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-044,10.10.3.144,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-11T21:35:02.192Z,2026-02-15T01:29:08.612Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-044,10.10.3.144,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-20T00:35:55.846Z,2026-02-13T22:04:14.343Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-044,10.10.3.144,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-12T00:27:50.050Z,2026-02-14T12:14:17.634Z,ACME\svc_backup
|
||||
ENG-WS-044,10.10.3.144,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T22:57:28.555Z,2026-02-18T21:33:18.664Z,ACME\svc_backup
|
||||
LEG-WS-045,10.10.1.145,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T00:38:54.627Z,2026-02-18T17:56:33.277Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-045,10.10.1.145,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-10T14:37:41.313Z,2026-02-16T03:33:54.586Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-045,10.10.1.145,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T11:30:41.181Z,2026-02-18T20:06:24.052Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-045,10.10.1.145,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T19:45:45.532Z,2026-02-18T08:32:51.250Z,ACME\svc_backup
|
||||
LEG-WS-045,10.10.1.145,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-10T17:46:03.622Z,2026-02-20T11:51:45.421Z,ACME\svc_backup
|
||||
MKT-WS-046,10.10.2.146,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-16T22:38:49.613Z,2026-02-16T05:01:54.471Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-046,10.10.2.146,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-19T07:31:12.356Z,2026-02-12T19:41:18.613Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-046,10.10.2.146,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T18:14:10.252Z,2026-02-18T21:06:38.332Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-046,10.10.2.146,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T16:48:36.176Z,2026-02-12T10:24:42.652Z,ACME\svc_backup
|
||||
MKT-WS-046,10.10.2.146,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T16:41:02.198Z,2026-02-11T06:13:28.016Z,ACME\svc_backup
|
||||
EXEC-WS-047,10.10.3.147,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T02:42:54.883Z,2026-02-14T01:24:49.703Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-047,10.10.3.147,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T15:48:14.287Z,2026-02-20T00:45:42.458Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-047,10.10.3.147,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-15T13:25:29.139Z,2026-02-20T01:58:50.715Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-047,10.10.3.147,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T02:20:08.558Z,2026-02-20T03:12:22.453Z,ACME\svc_backup
|
||||
EXEC-WS-047,10.10.3.147,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-14T19:24:32.981Z,2026-02-13T16:28:04.308Z,ACME\svc_backup
|
||||
IT-WS-048,10.10.1.148,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T12:59:56.698Z,2026-02-15T00:06:53.085Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-048,10.10.1.148,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-10T16:44:28.196Z,2026-02-10T13:19:02.999Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-048,10.10.1.148,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-19T03:03:43.877Z,2026-02-20T01:11:41.019Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-048,10.10.1.148,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T17:48:45.262Z,2026-02-12T11:18:22.491Z,ACME\svc_backup
|
||||
IT-WS-048,10.10.1.148,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-18T02:52:35.295Z,2026-02-14T11:47:48.053Z,ACME\svc_backup
|
||||
HR-WS-049,10.10.2.149,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T04:37:24.806Z,2026-02-10T11:16:11.052Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-049,10.10.2.149,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-18T15:02:20.807Z,2026-02-13T13:06:36.614Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-049,10.10.2.149,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T09:52:11.777Z,2026-02-20T11:28:16.172Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-049,10.10.2.149,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T13:41:44.249Z,2026-02-18T10:32:22.995Z,ACME\svc_backup
|
||||
HR-WS-049,10.10.2.149,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-10T08:52:45.463Z,2026-02-19T07:54:06.248Z,ACME\svc_backup
|
||||
FIN-WS-050,10.10.3.150,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-20T01:27:24.175Z,2026-02-12T00:27:05.551Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-050,10.10.3.150,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-18T05:29:47.321Z,2026-02-11T22:31:56.904Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-050,10.10.3.150,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-14T02:23:17.798Z,2026-02-12T10:19:53.923Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-050,10.10.3.150,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T02:07:34.737Z,2026-02-20T14:41:09.357Z,ACME\svc_backup
|
||||
FIN-WS-050,10.10.3.150,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-20T12:03:05.917Z,2026-02-11T02:15:28.141Z,ACME\svc_backup
|
||||
SLS-WS-051,10.10.1.151,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-19T08:04:34.795Z,2026-02-18T02:19:39.654Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-051,10.10.1.151,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-14T05:59:26.864Z,2026-02-13T08:09:26.358Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-051,10.10.1.151,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-12T13:09:01.056Z,2026-02-10T14:13:12.308Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-051,10.10.1.151,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T06:57:38.570Z,2026-02-15T06:36:07.347Z,ACME\svc_backup
|
||||
SLS-WS-051,10.10.1.151,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-11T12:53:38.656Z,2026-02-15T03:14:29.799Z,ACME\svc_backup
|
||||
ENG-WS-052,10.10.2.152,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-13T13:07:37.297Z,2026-02-10T12:55:55.898Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-052,10.10.2.152,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T10:00:16.639Z,2026-02-16T03:46:49.138Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-052,10.10.2.152,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-13T02:19:57.856Z,2026-02-11T13:16:14.889Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-052,10.10.2.152,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T10:22:57.217Z,2026-02-16T00:54:01.239Z,ACME\svc_backup
|
||||
ENG-WS-052,10.10.2.152,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-11T07:47:26.259Z,2026-02-11T17:00:25.634Z,ACME\svc_backup
|
||||
LEG-WS-053,10.10.3.153,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T15:39:26.774Z,2026-02-19T06:11:54.575Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-053,10.10.3.153,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T04:10:39.301Z,2026-02-15T12:39:57.869Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-053,10.10.3.153,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T09:45:50.659Z,2026-02-15T10:30:21.655Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-053,10.10.3.153,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T23:36:22.191Z,2026-02-19T01:55:34.033Z,ACME\svc_backup
|
||||
LEG-WS-053,10.10.3.153,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-15T01:07:59.017Z,2026-02-11T10:08:48.989Z,ACME\svc_backup
|
||||
MKT-WS-054,10.10.1.154,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-14T06:56:32.106Z,2026-02-16T04:16:55.893Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-054,10.10.1.154,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-17T13:40:54.674Z,2026-02-15T20:03:49.632Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-054,10.10.1.154,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-19T21:42:16.371Z,2026-02-12T07:23:59.445Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-054,10.10.1.154,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T08:29:32.052Z,2026-02-19T11:31:12.681Z,ACME\svc_backup
|
||||
MKT-WS-054,10.10.1.154,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T23:18:47.119Z,2026-02-14T10:16:53.168Z,ACME\svc_backup
|
||||
EXEC-WS-055,10.10.2.155,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T19:03:18.814Z,2026-02-13T08:28:03.971Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-055,10.10.2.155,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-12T13:51:42.917Z,2026-02-14T01:57:38.173Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-055,10.10.2.155,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T03:52:50.143Z,2026-02-20T13:49:39.549Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-055,10.10.2.155,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-11T19:17:28.469Z,2026-02-17T04:25:41.385Z,ACME\svc_backup
|
||||
EXEC-WS-055,10.10.2.155,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T01:38:12.857Z,2026-02-17T09:11:12.721Z,ACME\svc_backup
|
||||
IT-WS-056,10.10.3.156,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-11T16:17:49.377Z,2026-02-12T07:49:48.497Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-056,10.10.3.156,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-16T08:10:22.467Z,2026-02-12T19:09:24.082Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-056,10.10.3.156,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T04:59:44.480Z,2026-02-16T07:05:23.990Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-056,10.10.3.156,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T03:53:39.130Z,2026-02-17T22:35:46.400Z,ACME\svc_backup
|
||||
IT-WS-056,10.10.3.156,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T20:11:02.708Z,2026-02-20T08:46:24.560Z,ACME\svc_backup
|
||||
HR-WS-057,10.10.1.157,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-20T10:39:54.324Z,2026-02-14T02:12:25.423Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-057,10.10.1.157,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T00:56:51.206Z,2026-02-11T20:57:13.260Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-057,10.10.1.157,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-10T09:07:51.265Z,2026-02-10T17:23:37.684Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-057,10.10.1.157,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T14:05:45.700Z,2026-02-17T06:33:21.076Z,ACME\svc_backup
|
||||
HR-WS-057,10.10.1.157,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T21:53:43.467Z,2026-02-11T02:12:27.885Z,ACME\svc_backup
|
||||
FIN-WS-058,10.10.2.158,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-10T13:32:35.479Z,2026-02-13T08:00:30.042Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-058,10.10.2.158,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-11T00:40:20.335Z,2026-02-20T07:03:07.506Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-058,10.10.2.158,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-18T17:07:22.065Z,2026-02-10T09:32:20.210Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-058,10.10.2.158,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-14T13:48:44.200Z,2026-02-15T09:17:02.922Z,ACME\svc_backup
|
||||
FIN-WS-058,10.10.2.158,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-14T00:25:04.919Z,2026-02-11T04:12:54.828Z,ACME\svc_backup
|
||||
SLS-WS-059,10.10.3.159,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T19:33:58.088Z,2026-02-16T01:48:28.014Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-059,10.10.3.159,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T10:53:44.931Z,2026-02-13T22:45:45.235Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-059,10.10.3.159,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T16:54:07.752Z,2026-02-20T03:15:07.125Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-059,10.10.3.159,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-18T19:11:20.798Z,2026-02-12T05:42:12.676Z,ACME\svc_backup
|
||||
SLS-WS-059,10.10.3.159,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-20T06:10:59.244Z,2026-02-17T00:50:19.553Z,ACME\svc_backup
|
||||
ENG-WS-060,10.10.1.160,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-13T06:48:10.401Z,2026-02-11T07:39:25.302Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-060,10.10.1.160,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-10T12:25:18.134Z,2026-02-20T08:51:20.161Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-060,10.10.1.160,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-15T12:28:09.879Z,2026-02-16T14:08:21.881Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-060,10.10.1.160,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T19:00:48.687Z,2026-02-17T14:29:52.896Z,ACME\svc_backup
|
||||
ENG-WS-060,10.10.1.160,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-18T04:30:53.688Z,2026-02-19T00:51:38.463Z,ACME\svc_backup
|
||||
LEG-WS-061,10.10.2.161,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-20T15:20:33.774Z,2026-02-19T00:18:06.091Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-061,10.10.2.161,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-17T09:53:01.370Z,2026-02-17T01:31:51.621Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-061,10.10.2.161,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T18:43:59.956Z,2026-02-13T19:36:16.733Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-061,10.10.2.161,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T04:44:49.801Z,2026-02-16T22:10:39.417Z,ACME\svc_backup
|
||||
LEG-WS-061,10.10.2.161,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-11T04:39:19.292Z,2026-02-19T11:07:42.571Z,ACME\svc_backup
|
||||
MKT-WS-062,10.10.3.162,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-10T21:35:44.844Z,2026-02-15T04:09:40.629Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-062,10.10.3.162,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-10T17:57:20.101Z,2026-02-15T18:15:52.409Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-062,10.10.3.162,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T11:46:28.196Z,2026-02-14T23:39:55.119Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-062,10.10.3.162,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-15T03:32:12.866Z,2026-02-12T22:09:54.245Z,ACME\svc_backup
|
||||
MKT-WS-062,10.10.3.162,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T02:29:09.217Z,2026-02-12T13:19:08.503Z,ACME\svc_backup
|
||||
EXEC-WS-063,10.10.1.163,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T03:00:42.244Z,2026-02-17T22:26:46.243Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-063,10.10.1.163,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-16T03:37:31.456Z,2026-02-11T22:59:47.615Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-063,10.10.1.163,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-18T06:38:56.200Z,2026-02-12T00:19:22.109Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-063,10.10.1.163,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T20:19:30.773Z,2026-02-14T18:24:24.789Z,ACME\svc_backup
|
||||
EXEC-WS-063,10.10.1.163,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T12:01:11.381Z,2026-02-12T12:43:38.922Z,ACME\svc_backup
|
||||
IT-WS-064,10.10.2.164,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T17:21:12.376Z,2026-02-17T10:02:16.368Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-064,10.10.2.164,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-19T15:50:42.011Z,2026-02-12T17:58:19.048Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-064,10.10.2.164,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T01:49:38.430Z,2026-02-19T15:56:40.756Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-064,10.10.2.164,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-13T00:09:09.866Z,2026-02-15T08:41:11.447Z,ACME\svc_backup
|
||||
IT-WS-064,10.10.2.164,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T22:14:29.236Z,2026-02-10T22:02:56.979Z,ACME\svc_backup
|
||||
HR-WS-065,10.10.3.165,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T00:54:39.768Z,2026-02-19T16:47:40.687Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-065,10.10.3.165,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T23:21:31.438Z,2026-02-17T13:46:56.603Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-065,10.10.3.165,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-12T13:01:23.505Z,2026-02-15T11:44:53.742Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-065,10.10.3.165,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T19:31:04.992Z,2026-02-11T14:13:49.636Z,ACME\svc_backup
|
||||
HR-WS-065,10.10.3.165,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-13T05:03:45.358Z,2026-02-13T03:36:04.167Z,ACME\svc_backup
|
||||
FIN-WS-066,10.10.1.166,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-10T16:57:48.753Z,2026-02-18T06:52:33.511Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-066,10.10.1.166,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-18T20:24:17.462Z,2026-02-16T10:51:51.126Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-066,10.10.1.166,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-18T20:59:12.352Z,2026-02-10T18:15:22.831Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-066,10.10.1.166,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T14:13:08.229Z,2026-02-10T21:42:39.121Z,ACME\svc_backup
|
||||
FIN-WS-066,10.10.1.166,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-19T11:17:12.330Z,2026-02-14T13:02:38.561Z,ACME\svc_backup
|
||||
SLS-WS-067,10.10.2.167,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T06:44:14.817Z,2026-02-14T10:04:24.351Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-067,10.10.2.167,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T18:21:16.370Z,2026-02-13T11:47:39.420Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-067,10.10.2.167,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T23:53:09.292Z,2026-02-19T04:22:51.709Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-067,10.10.2.167,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-14T09:32:14.262Z,2026-02-13T23:55:00.827Z,ACME\svc_backup
|
||||
SLS-WS-067,10.10.2.167,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T03:33:11.712Z,2026-02-14T20:40:52.915Z,ACME\svc_backup
|
||||
ENG-WS-068,10.10.3.168,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-13T13:55:46.181Z,2026-02-11T19:23:09.804Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-068,10.10.3.168,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T11:33:54.705Z,2026-02-13T21:19:09.081Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-068,10.10.3.168,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T14:45:02.469Z,2026-02-11T20:36:25.115Z,NT AUTHORITY\SYSTEM
|
||||
ENG-WS-068,10.10.3.168,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-11T16:37:23.228Z,2026-02-14T13:57:15.793Z,ACME\svc_backup
|
||||
ENG-WS-068,10.10.3.168,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-13T14:02:01.808Z,2026-02-13T05:49:47.398Z,ACME\svc_backup
|
||||
LEG-WS-069,10.10.1.169,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T06:45:29.345Z,2026-02-12T03:16:18.194Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-069,10.10.1.169,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-14T08:20:40.685Z,2026-02-16T17:16:42.022Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-069,10.10.1.169,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-12T03:40:20.934Z,2026-02-15T15:18:01.003Z,NT AUTHORITY\SYSTEM
|
||||
LEG-WS-069,10.10.1.169,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T11:52:48.196Z,2026-02-16T16:16:13.339Z,ACME\svc_backup
|
||||
LEG-WS-069,10.10.1.169,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-11T02:55:43.227Z,2026-02-13T07:56:11.915Z,ACME\svc_backup
|
||||
MKT-WS-070,10.10.2.170,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T22:47:31.958Z,2026-02-17T15:06:34.912Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-070,10.10.2.170,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T02:08:07.289Z,2026-02-15T12:41:06.092Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-070,10.10.2.170,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-11T14:03:06.009Z,2026-02-12T23:21:43.664Z,NT AUTHORITY\SYSTEM
|
||||
MKT-WS-070,10.10.2.170,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T11:23:49.725Z,2026-02-15T17:20:03.103Z,ACME\svc_backup
|
||||
MKT-WS-070,10.10.2.170,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T05:45:14.665Z,2026-02-18T04:36:05.218Z,ACME\svc_backup
|
||||
EXEC-WS-071,10.10.3.171,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-19T21:58:07.627Z,2026-02-13T20:29:02.208Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-071,10.10.3.171,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T11:01:14.918Z,2026-02-17T22:49:52.939Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-071,10.10.3.171,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T21:55:41.932Z,2026-02-19T20:13:09.894Z,NT AUTHORITY\SYSTEM
|
||||
EXEC-WS-071,10.10.3.171,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T02:32:40.833Z,2026-02-12T14:25:25.075Z,ACME\svc_backup
|
||||
EXEC-WS-071,10.10.3.171,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-13T16:04:12.865Z,2026-02-15T22:04:39.245Z,ACME\svc_backup
|
||||
IT-WS-072,10.10.1.172,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T01:30:34.938Z,2026-02-18T16:57:52.320Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-072,10.10.1.172,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T11:00:21.112Z,2026-02-18T18:39:21.915Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-072,10.10.1.172,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-19T06:06:35.027Z,2026-02-19T19:07:43.006Z,NT AUTHORITY\SYSTEM
|
||||
IT-WS-072,10.10.1.172,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-13T22:19:29.987Z,2026-02-16T23:11:40.491Z,ACME\svc_backup
|
||||
IT-WS-072,10.10.1.172,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-12T14:46:23.485Z,2026-02-10T15:07:59.419Z,ACME\svc_backup
|
||||
HR-WS-073,10.10.2.173,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-17T18:06:47.797Z,2026-02-18T04:18:01.534Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-073,10.10.2.173,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-20T17:51:58.761Z,2026-02-20T00:44:00.041Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-073,10.10.2.173,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-17T07:20:04.569Z,2026-02-17T09:06:03.744Z,NT AUTHORITY\SYSTEM
|
||||
HR-WS-073,10.10.2.173,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-16T23:23:12.970Z,2026-02-11T15:43:15.739Z,ACME\svc_backup
|
||||
HR-WS-073,10.10.2.173,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T14:03:31.039Z,2026-02-15T04:51:55.591Z,ACME\svc_backup
|
||||
FIN-WS-074,10.10.3.174,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-16T20:00:55.479Z,2026-02-15T02:59:46.886Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-074,10.10.3.174,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T15:12:39.650Z,2026-02-11T03:38:35.784Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-074,10.10.3.174,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-20T04:55:05.330Z,2026-02-14T00:15:48.376Z,NT AUTHORITY\SYSTEM
|
||||
FIN-WS-074,10.10.3.174,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-10T18:50:31.495Z,2026-02-20T00:42:34.849Z,ACME\svc_backup
|
||||
FIN-WS-074,10.10.3.174,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-16T04:36:02.677Z,2026-02-14T12:21:16.058Z,ACME\svc_backup
|
||||
SLS-WS-075,10.10.1.175,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-19T13:23:32.622Z,2026-02-11T05:35:54.700Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-075,10.10.1.175,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-11T00:02:00.028Z,2026-02-11T01:58:38.127Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-075,10.10.1.175,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-19T00:28:03.739Z,2026-02-16T12:10:17.803Z,NT AUTHORITY\SYSTEM
|
||||
SLS-WS-075,10.10.1.175,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-18T21:54:47.101Z,2026-02-17T22:18:28.826Z,ACME\svc_backup
|
||||
SLS-WS-075,10.10.1.175,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-15T14:45:11.098Z,2026-02-17T00:26:03.139Z,ACME\svc_backup
|
||||
DC-01,10.10.1.10,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-18T05:34:55.315Z,2026-02-12T02:10:11.753Z,NT AUTHORITY\SYSTEM
|
||||
DC-01,10.10.1.10,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T06:31:45.770Z,2026-02-14T09:35:12.337Z,NT AUTHORITY\SYSTEM
|
||||
DC-01,10.10.1.10,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T23:45:01.815Z,2026-02-20T12:20:04.033Z,NT AUTHORITY\SYSTEM
|
||||
DC-01,10.10.1.10,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-14T12:56:42.532Z,2026-02-18T08:03:44.533Z,ACME\svc_backup
|
||||
DC-01,10.10.1.10,\ACME\Inventory,C:\Tools\inventory.exe --scan,False,2026-02-14T16:21:55.199Z,2026-02-10T10:37:33.447Z,ACME\svc_backup
|
||||
DC-02,10.10.2.10,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-12T21:41:33.305Z,2026-02-18T06:57:25.169Z,NT AUTHORITY\SYSTEM
|
||||
DC-02,10.10.2.10,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-19T11:04:47.035Z,2026-02-18T12:48:33.666Z,NT AUTHORITY\SYSTEM
|
||||
DC-02,10.10.2.10,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-16T15:09:33.108Z,2026-02-19T13:21:17.011Z,NT AUTHORITY\SYSTEM
|
||||
DC-02,10.10.2.10,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-11T04:53:25.476Z,2026-02-17T23:33:55.502Z,ACME\svc_backup
|
||||
DC-02,10.10.2.10,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-17T06:32:00.675Z,2026-02-12T03:16:42.034Z,ACME\svc_backup
|
||||
FILE-01,10.10.1.11,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-10T16:02:30.187Z,2026-02-18T19:56:12.599Z,NT AUTHORITY\SYSTEM
|
||||
FILE-01,10.10.1.11,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,False,2026-02-18T11:25:10.160Z,2026-02-11T15:30:06.173Z,NT AUTHORITY\SYSTEM
|
||||
FILE-01,10.10.1.11,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-14T03:21:46.273Z,2026-02-18T23:56:47.836Z,NT AUTHORITY\SYSTEM
|
||||
FILE-01,10.10.1.11,\ACME\Backup,C:\Tools\backup.ps1,True,2026-02-20T02:34:57.371Z,2026-02-12T20:01:23.947Z,ACME\svc_backup
|
||||
FILE-01,10.10.1.11,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-18T17:43:39.979Z,2026-02-12T10:42:19.061Z,ACME\svc_backup
|
||||
EXCH-01,10.10.1.12,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-15T15:10:43.406Z,2026-02-16T04:55:20.434Z,NT AUTHORITY\SYSTEM
|
||||
EXCH-01,10.10.1.12,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-13T17:09:26.090Z,2026-02-17T18:12:23.822Z,NT AUTHORITY\SYSTEM
|
||||
EXCH-01,10.10.1.12,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-20T16:29:42.205Z,2026-02-19T10:49:11.222Z,NT AUTHORITY\SYSTEM
|
||||
EXCH-01,10.10.1.12,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-11T18:25:07.936Z,2026-02-20T04:19:26.786Z,ACME\svc_backup
|
||||
EXCH-01,10.10.1.12,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-17T01:30:28.460Z,2026-02-13T05:57:34.175Z,ACME\svc_backup
|
||||
WEB-01,10.10.3.10,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,False,2026-02-12T12:22:58.456Z,2026-02-18T19:15:11.541Z,NT AUTHORITY\SYSTEM
|
||||
WEB-01,10.10.3.10,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T19:15:16.733Z,2026-02-14T08:34:13.004Z,NT AUTHORITY\SYSTEM
|
||||
WEB-01,10.10.3.10,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,False,2026-02-19T09:53:12.372Z,2026-02-17T02:59:14.291Z,NT AUTHORITY\SYSTEM
|
||||
WEB-01,10.10.3.10,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-15T21:38:04.019Z,2026-02-19T04:43:09.645Z,ACME\svc_backup
|
||||
WEB-01,10.10.3.10,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-10T12:59:56.574Z,2026-02-13T15:51:55.193Z,ACME\svc_backup
|
||||
SQL-01,10.10.2.11,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-14T02:24:22.229Z,2026-02-12T07:23:21.046Z,NT AUTHORITY\SYSTEM
|
||||
SQL-01,10.10.2.11,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-12T15:35:11.480Z,2026-02-11T07:46:47.657Z,NT AUTHORITY\SYSTEM
|
||||
SQL-01,10.10.2.11,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-13T09:04:33.741Z,2026-02-14T22:48:34.137Z,NT AUTHORITY\SYSTEM
|
||||
SQL-01,10.10.2.11,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-12T08:16:22.617Z,2026-02-18T21:46:16.878Z,ACME\svc_backup
|
||||
SQL-01,10.10.2.11,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-14T01:28:09.989Z,2026-02-19T03:38:03.534Z,ACME\svc_backup
|
||||
PROXY-01,10.10.1.13,\Microsoft\Windows\UpdateOrchestrator\Schedule Scan,C:\Windows\System32\usoclient.exe StartScan,True,2026-02-20T01:06:00.970Z,2026-02-13T05:34:29.899Z,NT AUTHORITY\SYSTEM
|
||||
PROXY-01,10.10.1.13,\Microsoft\Windows\Defrag\ScheduledDefrag,C:\Windows\System32\defrag.exe -c -h -o,True,2026-02-15T00:23:40.261Z,2026-02-19T05:33:16.704Z,NT AUTHORITY\SYSTEM
|
||||
PROXY-01,10.10.1.13,\Microsoft\Windows\WindowsUpdate\Automatic App Update,C:\Windows\System32\UsoClient.exe,True,2026-02-18T03:48:10.799Z,2026-02-15T08:41:54.461Z,NT AUTHORITY\SYSTEM
|
||||
PROXY-01,10.10.1.13,\ACME\Backup,C:\Tools\backup.ps1,False,2026-02-17T12:57:02.701Z,2026-02-16T21:29:03.726Z,ACME\svc_backup
|
||||
PROXY-01,10.10.1.13,\ACME\Inventory,C:\Tools\inventory.exe --scan,True,2026-02-12T07:58:03.576Z,2026-02-16T01:04:54.799Z,ACME\svc_backup
|
||||
|
1587
backend/tests/test_csvs/07_browser_history.csv
Normal file
1587
backend/tests/test_csvs/07_browser_history.csv
Normal file
File diff suppressed because it is too large
Load Diff
2518
backend/tests/test_csvs/08_sysmon_network.csv
Normal file
2518
backend/tests/test_csvs/08_sysmon_network.csv
Normal file
File diff suppressed because it is too large
Load Diff
343
backend/tests/test_csvs/09_autoruns.csv
Normal file
343
backend/tests/test_csvs/09_autoruns.csv
Normal file
@@ -0,0 +1,343 @@
|
||||
Hostname,IP,EntryName,EntryPath,Category,Enabled,Signer,MD5,Timestamp
|
||||
HR-WS-001,10.10.2.101,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f9476077f731904faca4ce51e8223280,2026-02-18T16:38:01.691Z
|
||||
HR-WS-001,10.10.2.101,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,22b9787216ab4bcc3e837fe83e56de08,2026-02-14T21:40:24.163Z
|
||||
HR-WS-001,10.10.2.101,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e12c4d94832bcfc10ea719ab8c7a1e99,2026-02-10T10:35:43.190Z
|
||||
HR-WS-001,10.10.2.101,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,c9b8d71ffc7f6ba6815406168fe0e504,2026-02-19T20:45:28.448Z
|
||||
HR-WS-001,10.10.2.101,Spotify,C:\Users\gwhite\AppData\Roaming\Spotify\Spotify.exe /minimized,Logon,True,(Not Signed),4a4348e3d4e5abb139eb31a3b3ab4a37,2026-02-12T07:14:11.363Z
|
||||
FIN-WS-002,10.10.3.102,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,9784945d50c553a038ce9d31f138eeb9,2026-02-16T01:53:59.986Z
|
||||
FIN-WS-002,10.10.3.102,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,51c836ed0b3c7aac59187f2703ba3d95,2026-02-19T12:05:46.600Z
|
||||
FIN-WS-002,10.10.3.102,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,68f003e65e14be3f618ede037c9f3492,2026-02-10T13:54:22.852Z
|
||||
FIN-WS-002,10.10.3.102,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,3ee5bb60071f8c1235df6330912221a3,2026-02-13T13:21:36.604Z
|
||||
SLS-WS-003,10.10.1.103,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f43330733bd73bdc0e2abaca445c0a67,2026-02-12T17:21:14.744Z
|
||||
SLS-WS-003,10.10.1.103,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,4584172477b2fe74ddbd894fcdaa90f3,2026-02-16T01:51:57.062Z
|
||||
SLS-WS-003,10.10.1.103,OneDrive,C:\Users\jsmith\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,6db277775cf2f8a3e0ee4f3f7ea19fde,2026-02-14T11:36:04.076Z
|
||||
SLS-WS-003,10.10.1.103,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,b340a11b84628d2589af707554dc54bf,2026-02-14T14:31:28.902Z
|
||||
ENG-WS-004,10.10.2.104,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,ee50eb7054466553636e1747152ebde2,2026-02-18T21:02:30.826Z
|
||||
ENG-WS-004,10.10.2.104,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,3c3e4d576f1dcb57dda69452d46826e2,2026-02-15T16:11:07.434Z
|
||||
ENG-WS-004,10.10.2.104,OneDrive,C:\Users\hbrown\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,4199e0bd2a0aba2a5b54f21e0f733fc1,2026-02-15T00:36:10.306Z
|
||||
ENG-WS-004,10.10.2.104,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,17409f9956b4cc3de140c4eb9bcb8821,2026-02-10T19:23:50.518Z
|
||||
LEG-WS-005,10.10.3.105,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,a6965636c44cb10326a6726a5cc7ef7c,2026-02-14T06:39:11.997Z
|
||||
LEG-WS-005,10.10.3.105,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,3efd102a59a6bb9659854dbe62960882,2026-02-18T00:05:24.622Z
|
||||
LEG-WS-005,10.10.3.105,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,a892151ba200fd042e6d747af87a58be,2026-02-14T21:09:26.910Z
|
||||
LEG-WS-005,10.10.3.105,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,2382aea96e53966d77f67564e8bb9a0a,2026-02-20T14:37:35.078Z
|
||||
MKT-WS-006,10.10.1.106,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,64b4fba1f06924f821641be3be48af45,2026-02-19T15:12:25.834Z
|
||||
MKT-WS-006,10.10.1.106,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,009b84037a7d13ccd7129ff2dcac4145,2026-02-16T08:31:47.006Z
|
||||
MKT-WS-006,10.10.1.106,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,c6bcda73bfffe297bfa33ac91aceb351,2026-02-15T13:56:06.927Z
|
||||
MKT-WS-006,10.10.1.106,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,a02b5071684ff75768995fb47ce19b3b,2026-02-13T10:48:36.068Z
|
||||
EXEC-WS-007,10.10.2.107,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,3d52771382b18b1ba9f65b5dadf05410,2026-02-14T21:11:18.000Z
|
||||
EXEC-WS-007,10.10.2.107,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,3611b573b586e247bd6e2a507ca21683,2026-02-11T07:26:19.949Z
|
||||
EXEC-WS-007,10.10.2.107,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,d9903e5eded038b3dc3c91f427409805,2026-02-20T10:29:46.612Z
|
||||
EXEC-WS-007,10.10.2.107,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,5a667b764bf6c0b500b45c7b66be2022,2026-02-18T19:47:32.890Z
|
||||
IT-WS-008,10.10.3.108,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,d4856492b7a3b2f2a6df99c73467a7df,2026-02-11T00:15:04.254Z
|
||||
IT-WS-008,10.10.3.108,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,bba6882e5e4c691a6be948be2bdb49ba,2026-02-11T05:06:51.041Z
|
||||
IT-WS-008,10.10.3.108,OneDrive,C:\Users\svc_sql\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e949a1d4c52013b98db0e82670c20b0f,2026-02-19T09:36:16.769Z
|
||||
IT-WS-008,10.10.3.108,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,19a1662d7a261f7c569de3dae84e3e46,2026-02-18T16:19:52.827Z
|
||||
HR-WS-009,10.10.1.109,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,035b97369bb068c1071c07fe79ed9db8,2026-02-13T18:48:23.256Z
|
||||
HR-WS-009,10.10.1.109,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,9192c986a04555c62ac2d111bae41dbf,2026-02-19T22:18:31.770Z
|
||||
HR-WS-009,10.10.1.109,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,07696f6a549fd643671fd3e7988b6c3a,2026-02-15T03:59:27.784Z
|
||||
HR-WS-009,10.10.1.109,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,61ad70133a4061a53f1bb15189f42acd,2026-02-17T17:53:33.602Z
|
||||
FIN-WS-010,10.10.2.110,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,7837891a3a1aa04f5b173d764d77c58c,2026-02-14T20:46:38.165Z
|
||||
FIN-WS-010,10.10.2.110,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,3d18d4bcf63d3d6616ba37dc0e04533e,2026-02-13T11:38:54.276Z
|
||||
FIN-WS-010,10.10.2.110,OneDrive,C:\Users\dlee\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,890d634cefc9a5575c6c916c2f4a9cd5,2026-02-11T03:52:37.756Z
|
||||
FIN-WS-010,10.10.2.110,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,184c45767f22c999e0c770716995e394,2026-02-17T17:38:37.540Z
|
||||
FIN-WS-010,10.10.2.110,uTorrent,C:\Users\dlee\AppData\Roaming\uTorrent\uTorrent.exe /minimized,Logon,True,(Not Signed),739ff4819dc765d9d1442fa9514ce5a3,2026-02-14T14:23:48.715Z
|
||||
SLS-WS-011,10.10.3.111,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,257302624c1d1b8ab6e41d64f386cd13,2026-02-14T14:18:31.992Z
|
||||
SLS-WS-011,10.10.3.111,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,2e7d979e1bbd4309ebfd30b771312520,2026-02-16T17:36:39.342Z
|
||||
SLS-WS-011,10.10.3.111,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,25ab312343a9b0f8dc132bcf529668f1,2026-02-17T18:55:31.648Z
|
||||
SLS-WS-011,10.10.3.111,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,907e662386549f04314d877f821e0f09,2026-02-16T07:37:15.438Z
|
||||
ENG-WS-012,10.10.1.112,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,a78f9f4d22b8ad4f1649b9451157b62a,2026-02-16T20:53:05.090Z
|
||||
ENG-WS-012,10.10.1.112,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,b7bcf70be51bffb5954b31802880fb7e,2026-02-16T00:23:19.427Z
|
||||
ENG-WS-012,10.10.1.112,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,33b121347f06281ed1f93461d317f81e,2026-02-20T10:49:15.804Z
|
||||
ENG-WS-012,10.10.1.112,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,3b03d2cb036d84e8e13b0cb450b4218b,2026-02-20T10:32:58.342Z
|
||||
LEG-WS-013,10.10.2.113,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f2d290a90081df0d39fb81c567d04776,2026-02-19T10:54:08.806Z
|
||||
LEG-WS-013,10.10.2.113,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,643804513444b466873e04fbb8c1e6b1,2026-02-13T09:02:59.760Z
|
||||
LEG-WS-013,10.10.2.113,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,7d019fd8a888bc50e95abdacdc9826d3,2026-02-16T03:01:45.895Z
|
||||
LEG-WS-013,10.10.2.113,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,08cae97b7813a4e56a551834a3acd593,2026-02-16T03:49:14.877Z
|
||||
LEG-WS-013,10.10.2.113,Discord,C:\Users\cjohnson\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),3f649a21c880cb1707c300cdf0cafc80,2026-02-18T00:57:58.524Z
|
||||
MKT-WS-014,10.10.3.114,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,13b2e547b818c31f445ef03f60c0f03f,2026-02-15T00:32:17.270Z
|
||||
MKT-WS-014,10.10.3.114,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,020100b29f3cef7e0d20805b2f6dcf6f,2026-02-16T04:50:18.379Z
|
||||
MKT-WS-014,10.10.3.114,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,104cbbea37b078846fb0ada324e071eb,2026-02-11T05:05:09.008Z
|
||||
MKT-WS-014,10.10.3.114,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,68be1255a2a881356089dca5b17f0235,2026-02-16T15:36:41.385Z
|
||||
MKT-WS-014,10.10.3.114,Steam,C:\Program Files (x86)\Steam\steam.exe -silent,Logon,True,(Not Signed),66cfdcdf2da7e2052a07ff85a398d38a,2026-02-14T22:28:49.877Z
|
||||
EXEC-WS-015,10.10.1.115,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,8a93b2a9ee834d7338c7190c5812b03d,2026-02-15T06:04:00.601Z
|
||||
EXEC-WS-015,10.10.1.115,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,5247e43ce576b5d8be2896d5352b3f2a,2026-02-16T13:10:55.685Z
|
||||
EXEC-WS-015,10.10.1.115,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,81f9a00e9e20223db4d10663bae6bed3,2026-02-17T08:00:37.595Z
|
||||
EXEC-WS-015,10.10.1.115,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,c735750ce48018ac577220efd90ae398,2026-02-11T12:26:22.399Z
|
||||
IT-WS-016,10.10.2.116,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,8deb9721364b822d96adf74e6b8a42d0,2026-02-19T01:58:36.892Z
|
||||
IT-WS-016,10.10.2.116,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,2365ad5ec8604ccf407870b6fc86f489,2026-02-11T15:03:21.222Z
|
||||
IT-WS-016,10.10.2.116,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,82b746aee8dc8483e0d14b477c0bf2e2,2026-02-18T20:43:58.890Z
|
||||
IT-WS-016,10.10.2.116,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,9709479b27d768d502a0f945c29b8f5e,2026-02-11T08:10:28.465Z
|
||||
HR-WS-017,10.10.3.117,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f11b2989e26d037388b3ae21ec50adb9,2026-02-11T00:31:37.655Z
|
||||
HR-WS-017,10.10.3.117,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,7ed41cd93f60a8667d4462fecef78b37,2026-02-12T22:22:11.343Z
|
||||
HR-WS-017,10.10.3.117,OneDrive,C:\Users\agarcia\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,19725dbc721037a8d3ec93c5809f695e,2026-02-19T08:33:19.727Z
|
||||
HR-WS-017,10.10.3.117,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e883d2362914c58532c69935075e2bbe,2026-02-20T02:29:55.060Z
|
||||
FIN-WS-018,10.10.1.118,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,b524a6ee7c336102b59fa2c02a6c871b,2026-02-14T21:17:01.353Z
|
||||
FIN-WS-018,10.10.1.118,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,64c8ce48ce5252706848a4523fa92126,2026-02-11T10:03:09.619Z
|
||||
FIN-WS-018,10.10.1.118,OneDrive,C:\Users\hbrown\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,05cc51d03c884751bcc4a123b0e7ce7f,2026-02-15T06:12:23.669Z
|
||||
FIN-WS-018,10.10.1.118,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,356ef7d8cfc147e714b76c36c3fac9f5,2026-02-16T03:23:24.079Z
|
||||
SLS-WS-019,10.10.2.119,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,49286eb5be41056b8597acc51222df6a,2026-02-14T09:14:46.487Z
|
||||
SLS-WS-019,10.10.2.119,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,0872ebbf4f5530d12a54f7cdec48a438,2026-02-17T10:58:19.296Z
|
||||
SLS-WS-019,10.10.2.119,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,abd58a27994096e52591b6ffea3783f9,2026-02-14T23:34:37.781Z
|
||||
SLS-WS-019,10.10.2.119,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,4527ee4ad703e9ec0d5e82564b6ef158,2026-02-17T04:34:55.933Z
|
||||
ENG-WS-020,10.10.3.120,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,4dfaca00b0e6732e8b04b2eb21c15db3,2026-02-15T17:58:58.872Z
|
||||
ENG-WS-020,10.10.3.120,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,1f6e64f67e4ecdb0449fda62aa787352,2026-02-19T21:29:34.931Z
|
||||
ENG-WS-020,10.10.3.120,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,6bdc5c8a846721d4a76e895c67561df0,2026-02-18T19:36:32.427Z
|
||||
ENG-WS-020,10.10.3.120,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,1d20b62a8f705ab66986598430c174bc,2026-02-15T16:55:52.609Z
|
||||
LEG-WS-021,10.10.1.121,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,e4d41589137b6a96abc2f55a3791be8d,2026-02-13T15:30:33.773Z
|
||||
LEG-WS-021,10.10.1.121,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,147dc74ec0816e16bf7529e6ae7e5a53,2026-02-14T15:22:57.108Z
|
||||
LEG-WS-021,10.10.1.121,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,bd4587b48ec4020debbbddaf7f89ea7a,2026-02-11T01:41:27.194Z
|
||||
LEG-WS-021,10.10.1.121,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,46917a79cff1dce33a17344c2027cc9b,2026-02-16T17:33:36.432Z
|
||||
MKT-WS-022,10.10.2.122,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,def371c941305a046248395d2a30760d,2026-02-14T08:04:10.599Z
|
||||
MKT-WS-022,10.10.2.122,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,d1ab02535208f9bb6a16ffdf9b6728f0,2026-02-20T08:11:56.232Z
|
||||
MKT-WS-022,10.10.2.122,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,86abf68ccbc0b4c3108763e003389b6c,2026-02-10T12:34:22.389Z
|
||||
MKT-WS-022,10.10.2.122,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,1d5541e9a0ae2ad772e57e5c7e14f5e7,2026-02-12T13:16:19.289Z
|
||||
EXEC-WS-023,10.10.3.123,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,71d6f451ec0ec214188617f3bde4684e,2026-02-13T16:17:00.055Z
|
||||
EXEC-WS-023,10.10.3.123,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,2153c162cc3012bc15e9cb60abd2beb1,2026-02-13T06:32:25.842Z
|
||||
EXEC-WS-023,10.10.3.123,OneDrive,C:\Users\svc_sql\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,4b5aea314b7dcbf04e795bd961078683,2026-02-11T16:12:54.402Z
|
||||
EXEC-WS-023,10.10.3.123,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e092c0fb7c52dce19b3d8dc3f33e3901,2026-02-14T16:32:21.336Z
|
||||
IT-WS-024,10.10.1.124,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,b6c7015c4dcbfacc3b0e1340c92d172a,2026-02-18T10:19:58.467Z
|
||||
IT-WS-024,10.10.1.124,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,00ac31fa29b3dff35072cafe76371b15,2026-02-19T15:14:39.012Z
|
||||
IT-WS-024,10.10.1.124,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,33b765b545fd45a83d19f0dc116303c8,2026-02-19T01:39:36.343Z
|
||||
IT-WS-024,10.10.1.124,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,2718bc3830483edb17e989e08f9c8fb5,2026-02-17T02:17:18.372Z
|
||||
HR-WS-025,10.10.2.125,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,56e53b7a62821a55258af76761ea1966,2026-02-14T18:40:44.549Z
|
||||
HR-WS-025,10.10.2.125,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,e4232abc36e81b10073bec33bb56d386,2026-02-15T23:11:54.823Z
|
||||
HR-WS-025,10.10.2.125,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,a402172a3ed4174b2fdafc567666b6da,2026-02-11T15:31:11.832Z
|
||||
HR-WS-025,10.10.2.125,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,c10c0af42f088f6b7357acbc09775fa8,2026-02-18T08:17:27.400Z
|
||||
FIN-WS-026,10.10.3.126,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,2fbbc6877d622feef68ffc65f1b497b8,2026-02-10T23:54:22.663Z
|
||||
FIN-WS-026,10.10.3.126,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,53d4cca3eda03f21675f3851158dc65b,2026-02-13T23:13:33.694Z
|
||||
FIN-WS-026,10.10.3.126,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,ac6bf1769af34c99f27c717ef5af0d40,2026-02-17T18:50:56.934Z
|
||||
FIN-WS-026,10.10.3.126,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,7c6a48b9eb64fba9537361bf03f48476,2026-02-19T13:08:39.543Z
|
||||
FIN-WS-026,10.10.3.126,uTorrent,C:\Users\bwilson\AppData\Roaming\uTorrent\uTorrent.exe /minimized,Logon,True,(Not Signed),d62e227614d0b1c5ece4ae2285bca535,2026-02-15T02:40:04.600Z
|
||||
SLS-WS-027,10.10.1.127,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,314a1fa1648cf1937bba36649ac71406,2026-02-16T16:59:40.073Z
|
||||
SLS-WS-027,10.10.1.127,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,71f4848f3579531726169015b8fe25d8,2026-02-11T17:18:52.433Z
|
||||
SLS-WS-027,10.10.1.127,OneDrive,C:\Users\jsmith\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,bcfd766327e1b751c75678cb49a947a5,2026-02-18T02:46:31.650Z
|
||||
SLS-WS-027,10.10.1.127,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,3e86a3eab1378f974b78dca84c9b8d61,2026-02-13T07:47:34.502Z
|
||||
ENG-WS-028,10.10.2.128,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,334d2603842c94b82319a2f73e628825,2026-02-14T20:37:13.140Z
|
||||
ENG-WS-028,10.10.2.128,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,ad5f1aa1f564391827db75bdc0470b91,2026-02-16T01:05:12.568Z
|
||||
ENG-WS-028,10.10.2.128,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,fed764abbda0a135fefbf3d0f4336932,2026-02-15T06:23:54.909Z
|
||||
ENG-WS-028,10.10.2.128,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,836b3596ccf5e97afb6ea50600828378,2026-02-19T19:21:30.616Z
|
||||
LEG-WS-029,10.10.3.129,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,29a32d4dbadce2590aa2ec00ecb9a3e8,2026-02-17T23:00:03.452Z
|
||||
LEG-WS-029,10.10.3.129,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,806e0d560c68c0d16c00bdeb38237f60,2026-02-20T04:19:14.893Z
|
||||
LEG-WS-029,10.10.3.129,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,b47af555bb8f26a514017faba2811633,2026-02-13T03:45:42.890Z
|
||||
LEG-WS-029,10.10.3.129,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,7c127e96cd46d111230479e3ad7ce00b,2026-02-13T07:14:54.166Z
|
||||
MKT-WS-030,10.10.1.130,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,1e72ddbb8a43a6338cd9292998369288,2026-02-18T01:53:46.382Z
|
||||
MKT-WS-030,10.10.1.130,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,b664ea6bdaae1a85803ff8384e1e22d3,2026-02-12T02:13:32.177Z
|
||||
MKT-WS-030,10.10.1.130,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,7a49d8ac591de6c1668c1a925cc87126,2026-02-11T09:16:29.394Z
|
||||
MKT-WS-030,10.10.1.130,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,425471ef3c40d97e8468dd87d12fb5fd,2026-02-16T06:17:51.666Z
|
||||
EXEC-WS-031,10.10.2.131,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,53802a9758578dd99ad67558e04a4d1e,2026-02-14T01:01:05.786Z
|
||||
EXEC-WS-031,10.10.2.131,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,c5809b61bf61d71f627cd3b9a8098bd9,2026-02-18T20:26:29.082Z
|
||||
EXEC-WS-031,10.10.2.131,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e9f839f0536cddb42725b33b51edfb0d,2026-02-14T17:13:26.254Z
|
||||
EXEC-WS-031,10.10.2.131,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,be25d2578c527a3a93c3d6d5512d4d99,2026-02-14T07:14:54.730Z
|
||||
IT-WS-032,10.10.3.132,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,573fbf0d2247b7cf6d1616ace82eadf6,2026-02-14T19:06:58.657Z
|
||||
IT-WS-032,10.10.3.132,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,a185649a31ae55760a8940c28c44adcc,2026-02-19T19:34:20.023Z
|
||||
IT-WS-032,10.10.3.132,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,3a940ae061d746f6e7d0d053be9d80fb,2026-02-17T01:03:18.593Z
|
||||
IT-WS-032,10.10.3.132,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e9372174a9ee2f3b313b929f7aa873b8,2026-02-12T12:36:51.081Z
|
||||
HR-WS-033,10.10.1.133,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,049542cdf146c7b80e285b1d9b89598e,2026-02-20T10:01:35.399Z
|
||||
HR-WS-033,10.10.1.133,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,c04ec3ba6b7e7d5a7e3fbbc1413191d4,2026-02-20T08:36:26.722Z
|
||||
HR-WS-033,10.10.1.133,OneDrive,C:\Users\svc_web\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,cfe1493ac15585198b1b5ec006b76b7b,2026-02-19T02:06:29.224Z
|
||||
HR-WS-033,10.10.1.133,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,a09c06d692c5b5720bfeaea892164f48,2026-02-12T01:08:50.432Z
|
||||
FIN-WS-034,10.10.2.134,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,413c77401d948cf3caefd479307d5f34,2026-02-13T03:38:39.557Z
|
||||
FIN-WS-034,10.10.2.134,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,15ddf4d2f0cf6627eb77ef4469a9cdc1,2026-02-12T05:07:11.172Z
|
||||
FIN-WS-034,10.10.2.134,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,d9cb45325fbbd6dd58b519a4b530dd29,2026-02-11T09:31:43.114Z
|
||||
FIN-WS-034,10.10.2.134,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,7f4260b664530f30a715023294e5ede6,2026-02-15T10:28:51.266Z
|
||||
SLS-WS-035,10.10.3.135,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,466275f3c677ad330f3405748012527c,2026-02-18T07:53:54.151Z
|
||||
SLS-WS-035,10.10.3.135,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,c7b8ec3f1db8662ed6ef334da37ed2b4,2026-02-10T12:38:49.511Z
|
||||
SLS-WS-035,10.10.3.135,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,99dd178ae3e335f9cf10abf48551cd83,2026-02-13T11:33:10.057Z
|
||||
SLS-WS-035,10.10.3.135,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,f3c98d1e56fb4ae5c5127b93910393cb,2026-02-14T14:42:54.688Z
|
||||
ENG-WS-036,10.10.1.136,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f335f5dee2b627ddd98ac77aef14493f,2026-02-19T14:14:30.311Z
|
||||
ENG-WS-036,10.10.1.136,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,e4e41f2c1e8c14009a5848d8d9325bd4,2026-02-19T15:52:22.084Z
|
||||
ENG-WS-036,10.10.1.136,OneDrive,C:\Users\svc_web\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,41df5e0402b7cf78ae7e9808827b18f0,2026-02-14T04:58:48.582Z
|
||||
ENG-WS-036,10.10.1.136,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,38ea68957c15ac8726ec5fd21a2ba7c1,2026-02-13T07:43:35.228Z
|
||||
LEG-WS-037,10.10.2.137,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,e7048b4e5ccce823b15a019ac56e231a,2026-02-17T15:19:52.037Z
|
||||
LEG-WS-037,10.10.2.137,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,368a1d6f2c21d1286a578fa8d0d8464d,2026-02-11T19:18:33.346Z
|
||||
LEG-WS-037,10.10.2.137,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,0ea7edfba739e329606025b79e278a5d,2026-02-11T14:38:55.720Z
|
||||
LEG-WS-037,10.10.2.137,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,3efd1a5f4bfe0d8e9c8f9386bd64ca9f,2026-02-14T10:06:13.090Z
|
||||
MKT-WS-038,10.10.3.138,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,cb8dcf4319fd39d7a85bcca0e7fbefb5,2026-02-16T10:16:07.373Z
|
||||
MKT-WS-038,10.10.3.138,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,982b2809524187b9ec74f543773e2764,2026-02-12T17:32:52.719Z
|
||||
MKT-WS-038,10.10.3.138,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,73819da1fee2c45962fe20f89c946299,2026-02-18T11:57:51.031Z
|
||||
MKT-WS-038,10.10.3.138,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,74dd81fe3a2d1ea0a482542378fb1048,2026-02-17T06:24:24.573Z
|
||||
MKT-WS-038,10.10.3.138,uTorrent,C:\Users\svc_backup\AppData\Roaming\uTorrent\uTorrent.exe /minimized,Logon,True,(Not Signed),e8920ccdcd86e6a50d2d7b62bdaa7a9c,2026-02-11T18:39:11.639Z
|
||||
EXEC-WS-039,10.10.1.139,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,ffc64af0d4ca8bd246ec913acaf3fb5e,2026-02-17T14:58:56.781Z
|
||||
EXEC-WS-039,10.10.1.139,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,7c3be0a36ee731522b38337911396c2c,2026-02-14T17:20:30.212Z
|
||||
EXEC-WS-039,10.10.1.139,OneDrive,C:\Users\svc_web\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,01a10918020665bcf838fbdfc4403437,2026-02-15T14:16:32.017Z
|
||||
EXEC-WS-039,10.10.1.139,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,250facb86fab9442299bc0e1abb659b5,2026-02-19T21:17:30.543Z
|
||||
IT-WS-040,10.10.2.140,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,6d209bc687694750e032c8db032fb3ff,2026-02-11T23:34:29.166Z
|
||||
IT-WS-040,10.10.2.140,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,8facdb1c57ff34148b820dab80f9e383,2026-02-10T23:23:33.944Z
|
||||
IT-WS-040,10.10.2.140,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,32f2c2bdb3ece1d25d9ff9b7dd75d281,2026-02-17T01:17:48.914Z
|
||||
IT-WS-040,10.10.2.140,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,c9e4d9ba6e9e9e5f89ebb925b2e748e4,2026-02-15T10:58:20.228Z
|
||||
HR-WS-041,10.10.3.141,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,32bf75f700df41e3d546e69a4b0cacfc,2026-02-17T21:08:02.897Z
|
||||
HR-WS-041,10.10.3.141,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,972852b0380734de6e92f320a28ff149,2026-02-20T16:59:40.093Z
|
||||
HR-WS-041,10.10.3.141,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,2d84ee72f12e76ffe4f1dbae553e4ce5,2026-02-12T08:49:33.876Z
|
||||
HR-WS-041,10.10.3.141,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,076bf4dbffd9edb921ed3678461babac,2026-02-13T23:15:44.185Z
|
||||
FIN-WS-042,10.10.1.142,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,006f3d453ef6527412ad58ca63aa6ff4,2026-02-10T12:17:12.913Z
|
||||
FIN-WS-042,10.10.1.142,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,7df4e3ee708a19f4629c9dbe517a2e88,2026-02-11T06:59:53.755Z
|
||||
FIN-WS-042,10.10.1.142,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,bb0060178f9a918c28213218121d2e26,2026-02-17T13:58:06.447Z
|
||||
FIN-WS-042,10.10.1.142,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,03845bd5e3d576b009a077818a0bf3f3,2026-02-19T08:29:17.982Z
|
||||
FIN-WS-042,10.10.1.142,Discord,C:\Users\fthompson\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),d3298e51be33515aeae92b10679c3276,2026-02-12T12:13:15.783Z
|
||||
SLS-WS-043,10.10.2.143,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,8f18a377b282e91cd1e173eee85f1169,2026-02-19T05:53:43.501Z
|
||||
SLS-WS-043,10.10.2.143,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,fe0a63d4d33b3d7b09f1a513cb3cf4bd,2026-02-12T07:09:06.629Z
|
||||
SLS-WS-043,10.10.2.143,OneDrive,C:\Users\dlee\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,7c3cbbb94c63c61b45d23df163cdacfa,2026-02-20T09:07:25.273Z
|
||||
SLS-WS-043,10.10.2.143,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,41a7e4e78ca47e38f2ae59fe95dbaa1f,2026-02-10T15:45:33.709Z
|
||||
ENG-WS-044,10.10.3.144,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,5c064bc2b3b12f1ba13adba76926666e,2026-02-19T14:53:50.194Z
|
||||
ENG-WS-044,10.10.3.144,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,e9c9d85d5fb0e0925e70aca2a5ebc14b,2026-02-15T00:21:57.235Z
|
||||
ENG-WS-044,10.10.3.144,OneDrive,C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,2e4da91d64ffbc3661df6c7732f27124,2026-02-13T11:34:37.418Z
|
||||
ENG-WS-044,10.10.3.144,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,a53afa45e3a5f0c5aa081a51a5c2cd9a,2026-02-11T12:55:15.217Z
|
||||
LEG-WS-045,10.10.1.145,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,daae08e18b96f0e17083b00dbbba43f3,2026-02-20T11:00:50.597Z
|
||||
LEG-WS-045,10.10.1.145,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,8000dfa77499f64504acd544c9ed2b44,2026-02-15T18:57:22.470Z
|
||||
LEG-WS-045,10.10.1.145,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,736de40e986b7001b9d51d9dfffc4393,2026-02-20T13:55:53.607Z
|
||||
LEG-WS-045,10.10.1.145,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,f5fe66325792c8ad14858cd514ef0c49,2026-02-18T16:15:00.214Z
|
||||
MKT-WS-046,10.10.2.146,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,98dd029b72034c677b77cbb4baba2f19,2026-02-16T23:41:33.531Z
|
||||
MKT-WS-046,10.10.2.146,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,51059e8db4e2ecaea0d9afec8ac888d6,2026-02-20T00:06:13.727Z
|
||||
MKT-WS-046,10.10.2.146,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,2464332ad026b59fcf540a2df3c7563b,2026-02-14T21:01:25.203Z
|
||||
MKT-WS-046,10.10.2.146,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,0e7912a0ac8e8400841afe8e1d26c752,2026-02-12T07:16:24.517Z
|
||||
EXEC-WS-047,10.10.3.147,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,c27973488fa8d6ccc35b45bbcbfcf1ec,2026-02-17T02:00:33.402Z
|
||||
EXEC-WS-047,10.10.3.147,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,2af2cfa5d01a2ce0d8dd99daf73a3208,2026-02-12T03:02:45.368Z
|
||||
EXEC-WS-047,10.10.3.147,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,9e74515aa29a7b3e5d8bd16092755e08,2026-02-18T13:30:31.571Z
|
||||
EXEC-WS-047,10.10.3.147,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,69b94d10458fe7f56e5a1c48a610e441,2026-02-10T11:18:38.294Z
|
||||
IT-WS-048,10.10.1.148,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,c16b145ffc51ff16c7100a9ce1ed7145,2026-02-18T17:24:24.371Z
|
||||
IT-WS-048,10.10.1.148,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,8115abbff0e6ed6a8f0502c5d66a164b,2026-02-15T14:36:56.923Z
|
||||
IT-WS-048,10.10.1.148,OneDrive,C:\Users\svc_web\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,80ea42f5e586d1396b59ca4a4379980c,2026-02-17T19:47:20.951Z
|
||||
IT-WS-048,10.10.1.148,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,978aa10480ffe0c32e7928077dddee59,2026-02-12T15:47:32.226Z
|
||||
HR-WS-049,10.10.2.149,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f18d6a9ca22157827344faad6edc3f43,2026-02-16T21:28:27.865Z
|
||||
HR-WS-049,10.10.2.149,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,ccc68355f8a4824c1f55304c7b9c1821,2026-02-18T17:48:34.613Z
|
||||
HR-WS-049,10.10.2.149,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,7aec94942f186eb470473d02acca2c41,2026-02-10T10:53:46.013Z
|
||||
HR-WS-049,10.10.2.149,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,7f0644cea5e9d5e9074c241b5d305777,2026-02-15T16:24:04.628Z
|
||||
FIN-WS-050,10.10.3.150,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,e770d168aad26f9aa80dfccf1456b33e,2026-02-11T03:25:16.210Z
|
||||
FIN-WS-050,10.10.3.150,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,572f3c3ecbcd7e348201d540d845035a,2026-02-12T14:56:55.158Z
|
||||
FIN-WS-050,10.10.3.150,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,9c5adbcd1738c3a86edebbf0973dfb5f,2026-02-17T11:15:30.182Z
|
||||
FIN-WS-050,10.10.3.150,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,0b272489c6c0815115c8bd238398a884,2026-02-16T01:22:35.399Z
|
||||
FIN-WS-050,10.10.3.150,Discord,C:\Users\gwhite\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),aa339164d7d31497cc642c6902451906,2026-02-16T07:27:26.567Z
|
||||
SLS-WS-051,10.10.1.151,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,e32cd3849f82c4860435fafa7dc815c2,2026-02-11T23:42:50.015Z
|
||||
SLS-WS-051,10.10.1.151,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,c87049028ccc42c31ceb5ce9453eb07d,2026-02-17T08:44:11.345Z
|
||||
SLS-WS-051,10.10.1.151,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,0d0a3a879f3a49cfb08f26177867d9e9,2026-02-15T11:26:48.618Z
|
||||
SLS-WS-051,10.10.1.151,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,05bb54baf4ce2358d13fcc4848aa33b6,2026-02-16T19:58:21.694Z
|
||||
ENG-WS-052,10.10.2.152,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,2f9ef5c9bcdffb9ef50fadb3fb7b3071,2026-02-13T05:29:22.387Z
|
||||
ENG-WS-052,10.10.2.152,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,8af8f892378d437d4d1c8a4a51be47d3,2026-02-10T12:34:37.519Z
|
||||
ENG-WS-052,10.10.2.152,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,23f56f0691a732c5d268a503d0661c73,2026-02-14T17:20:11.430Z
|
||||
ENG-WS-052,10.10.2.152,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,488635a51a8db16a96ab5b2486b3e99b,2026-02-16T03:58:31.008Z
|
||||
LEG-WS-053,10.10.3.153,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,277f4ae42f54b415f5674f0399d48851,2026-02-19T01:02:29.576Z
|
||||
LEG-WS-053,10.10.3.153,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,7b6df8a41be6c0d22c967cc940696e09,2026-02-14T02:21:58.061Z
|
||||
LEG-WS-053,10.10.3.153,OneDrive,C:\Users\dlee\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,094b1cefcf394930bc9193a446c9c6d9,2026-02-12T23:39:58.180Z
|
||||
LEG-WS-053,10.10.3.153,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,6ee42997d46f4dc9d4266b1c8f182927,2026-02-20T06:43:48.545Z
|
||||
MKT-WS-054,10.10.1.154,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,987bbb22c8cdb20ab790c330bc961b58,2026-02-13T18:56:44.135Z
|
||||
MKT-WS-054,10.10.1.154,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,121570d56e4b522c211a5b0369ba8b38,2026-02-20T04:26:12.326Z
|
||||
MKT-WS-054,10.10.1.154,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,91537e600e667e639b1ec1ad951a5fd3,2026-02-18T09:14:35.557Z
|
||||
MKT-WS-054,10.10.1.154,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,92c9384f5a03393796327699fec5f20a,2026-02-17T00:58:48.519Z
|
||||
EXEC-WS-055,10.10.2.155,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,df44882927d4f15391536dfc26a8c0bd,2026-02-10T09:59:08.913Z
|
||||
EXEC-WS-055,10.10.2.155,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,e1081eb13daef772716fc648bc238c07,2026-02-19T21:26:09.314Z
|
||||
EXEC-WS-055,10.10.2.155,OneDrive,C:\Users\fthompson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,1467e33b648b9abf5adf4a2ada8e387b,2026-02-15T16:27:13.551Z
|
||||
EXEC-WS-055,10.10.2.155,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,c18d8b93bd24e6cf73d50e22d9d78bb7,2026-02-10T20:40:35.229Z
|
||||
IT-WS-056,10.10.3.156,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,ca730f1d3a62ab91e55fd3dd4a600fb1,2026-02-18T03:17:40.085Z
|
||||
IT-WS-056,10.10.3.156,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,9eca3a6acefa22b5a0ee9f8d1d12b2b1,2026-02-18T04:32:03.354Z
|
||||
IT-WS-056,10.10.3.156,OneDrive,C:\Users\dlee\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,a3cbfa1a00b8118d5fe27a5794d8b5ee,2026-02-19T05:02:49.038Z
|
||||
IT-WS-056,10.10.3.156,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,6ea8ee29b08a081ebba72ec11b598d87,2026-02-10T17:29:22.882Z
|
||||
HR-WS-057,10.10.1.157,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,58ecaffac946cc370d322cba869edfe4,2026-02-13T11:35:42.464Z
|
||||
HR-WS-057,10.10.1.157,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,f56143391ddff8edfa9ccdfe51f476b2,2026-02-10T21:38:04.419Z
|
||||
HR-WS-057,10.10.1.157,OneDrive,C:\Users\svc_sql\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,d41b4fae62fe7a33a43582fff6d926c9,2026-02-14T18:22:05.932Z
|
||||
HR-WS-057,10.10.1.157,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,383a872eeb9de9cdc065257155cb4200,2026-02-14T06:09:45.704Z
|
||||
FIN-WS-058,10.10.2.158,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,a4a6a20b403b4fc19102305a6e4fd94e,2026-02-10T08:42:35.702Z
|
||||
FIN-WS-058,10.10.2.158,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,48143f42f576ae575ebfece272765c11,2026-02-19T04:41:14.049Z
|
||||
FIN-WS-058,10.10.2.158,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,d9bfc51ac72f1e6b21fa53b2bd2a02b0,2026-02-11T04:32:01.045Z
|
||||
FIN-WS-058,10.10.2.158,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,8d5a44fb24c3c11874008e77b825743f,2026-02-14T20:19:16.665Z
|
||||
FIN-WS-058,10.10.2.158,Discord,C:\Users\cjohnson\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),cf58eaed9e013bc38819bd998b969616,2026-02-10T12:16:52.144Z
|
||||
SLS-WS-059,10.10.3.159,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,e3c74c9e8c3492cae2b9a71a1e427585,2026-02-19T22:17:09.337Z
|
||||
SLS-WS-059,10.10.3.159,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,fe9249491447329754fa3ae5cc2050ac,2026-02-18T05:39:20.950Z
|
||||
SLS-WS-059,10.10.3.159,OneDrive,C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,b50cf05fc070879415afdff534325531,2026-02-13T15:09:06.895Z
|
||||
SLS-WS-059,10.10.3.159,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,a117e1a617bab8831ce6dd4e4fba6d67,2026-02-15T14:14:24.306Z
|
||||
SLS-WS-059,10.10.3.159,Discord,C:\Users\admin\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),f91869f509fdbce7a300cd698e9d3de8,2026-02-17T16:51:11.312Z
|
||||
ENG-WS-060,10.10.1.160,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,5e3fb72ba3dc555cc44077769be8ce5d,2026-02-10T15:01:52.042Z
|
||||
ENG-WS-060,10.10.1.160,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,25abfcfe6042e882f58b36d0ae662e30,2026-02-13T17:28:08.992Z
|
||||
ENG-WS-060,10.10.1.160,OneDrive,C:\Users\agarcia\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,ed45996c6ab270febf0e20503e0901f2,2026-02-14T14:08:35.251Z
|
||||
ENG-WS-060,10.10.1.160,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,25360d7653284e5ce57d014c5f5fa344,2026-02-19T19:59:32.408Z
|
||||
LEG-WS-061,10.10.2.161,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,5e9fabf85430c116dbe504e81ac3f79b,2026-02-17T10:28:34.683Z
|
||||
LEG-WS-061,10.10.2.161,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,a8be97cc47061d65abe719d11b4f0c85,2026-02-17T06:25:12.347Z
|
||||
LEG-WS-061,10.10.2.161,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,74a40f54e3fe117be1c980697c2c37a3,2026-02-19T00:01:37.208Z
|
||||
LEG-WS-061,10.10.2.161,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,1dfe7db59f003be66178f993295bb56a,2026-02-12T03:43:03.285Z
|
||||
LEG-WS-061,10.10.2.161,Discord,C:\Users\bwilson\AppData\Local\Discord\Update.exe --processStart Discord.exe,Logon,True,(Not Signed),d1b0abd2bb61d4cd50f917b77257834f,2026-02-16T20:47:33.918Z
|
||||
MKT-WS-062,10.10.3.162,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,3138daa62a744df11adbc154d5643e7c,2026-02-19T22:15:20.157Z
|
||||
MKT-WS-062,10.10.3.162,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,2fa02cc9d22691833f64f4149a28e9a5,2026-02-14T09:26:09.982Z
|
||||
MKT-WS-062,10.10.3.162,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,6eb0f457f1f4c1308b994c881de7eaf8,2026-02-16T17:09:20.065Z
|
||||
MKT-WS-062,10.10.3.162,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,67609be7d4e999c1d5dfc3aa489274ec,2026-02-20T15:40:16.621Z
|
||||
EXEC-WS-063,10.10.1.163,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,ba697671060136ab33909c410f80e42c,2026-02-18T19:02:36.065Z
|
||||
EXEC-WS-063,10.10.1.163,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,a13556cef9f10cc12550f7c2620a5202,2026-02-11T05:27:32.442Z
|
||||
EXEC-WS-063,10.10.1.163,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,f677999b0375185656d9ef8ce716a578,2026-02-13T01:51:56.607Z
|
||||
EXEC-WS-063,10.10.1.163,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,ad61a6340315e733677af5c5780f5316,2026-02-17T14:44:49.088Z
|
||||
IT-WS-064,10.10.2.164,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,56c40e3fbf9bf2370cd8a93138fe9128,2026-02-17T06:05:14.098Z
|
||||
IT-WS-064,10.10.2.164,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,ee030cf6ceb536c1fbca61f2fa340b4f,2026-02-11T10:37:43.803Z
|
||||
IT-WS-064,10.10.2.164,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,38ed7f369c3d7f3d5c89d4cae1e8f56c,2026-02-15T07:49:13.007Z
|
||||
IT-WS-064,10.10.2.164,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,736cb1859c8110049369075c36cd11f7,2026-02-13T08:14:54.300Z
|
||||
HR-WS-065,10.10.3.165,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,795538f956cdef5781af357031304dbd,2026-02-11T14:15:29.330Z
|
||||
HR-WS-065,10.10.3.165,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,dc07973ee58d79940996e8e4458dd89a,2026-02-12T08:02:58.202Z
|
||||
HR-WS-065,10.10.3.165,OneDrive,C:\Users\svc_backup\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,2bbf153fa9968949c640d202021d8e3f,2026-02-13T20:51:22.220Z
|
||||
HR-WS-065,10.10.3.165,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,66df52a3fe1471696f506a4a2690b357,2026-02-10T13:21:44.634Z
|
||||
FIN-WS-066,10.10.1.166,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,69a94cf819533dd10e7ec76b0b77032a,2026-02-16T02:04:37.083Z
|
||||
FIN-WS-066,10.10.1.166,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,7d2e14e4796e51be1206a7abfd70c202,2026-02-17T07:51:27.575Z
|
||||
FIN-WS-066,10.10.1.166,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e9dedc92ce86477003bbad2c26f2dc1d,2026-02-10T10:38:27.985Z
|
||||
FIN-WS-066,10.10.1.166,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e68e585e83f868742c5f51b5feb72b72,2026-02-11T05:26:00.039Z
|
||||
FIN-WS-066,10.10.1.166,Steam,C:\Program Files (x86)\Steam\steam.exe -silent,Logon,True,(Not Signed),dacabfae9c7421ad3011a0eadf3e0443,2026-02-13T09:11:29.353Z
|
||||
SLS-WS-067,10.10.2.167,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,5f51d7d0e8888e07990da248c12efc6a,2026-02-17T15:19:00.925Z
|
||||
SLS-WS-067,10.10.2.167,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,b2b52fd93f2a11da12ccbae1e3f01fdf,2026-02-18T17:22:50.656Z
|
||||
SLS-WS-067,10.10.2.167,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,eaeb983924bde23dc828cffacc2fa365,2026-02-14T17:13:54.310Z
|
||||
SLS-WS-067,10.10.2.167,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,cb6d47768131e6cb2e6b789c01badb1d,2026-02-13T04:54:44.965Z
|
||||
ENG-WS-068,10.10.3.168,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,1d78072736aaf3b08dbfda72b303bcd1,2026-02-12T10:17:52.651Z
|
||||
ENG-WS-068,10.10.3.168,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,e475c94081df0af0bb76745351b2d40c,2026-02-15T19:49:17.801Z
|
||||
ENG-WS-068,10.10.3.168,OneDrive,C:\Users\jsmith\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e5992ba9a161353da4d300ca1ce2a1f3,2026-02-17T08:26:41.519Z
|
||||
ENG-WS-068,10.10.3.168,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,2d4cab9657ebeb3c2177531acbf581e3,2026-02-10T18:16:25.140Z
|
||||
LEG-WS-069,10.10.1.169,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,b1483fd46b2b62ebadd883c80938d34d,2026-02-13T07:53:52.108Z
|
||||
LEG-WS-069,10.10.1.169,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,8ce9fcda50019e404015bde12c5a98ca,2026-02-13T04:05:14.999Z
|
||||
LEG-WS-069,10.10.1.169,OneDrive,C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,4d24770fc83650ed89854b3cb253a557,2026-02-16T04:01:07.901Z
|
||||
LEG-WS-069,10.10.1.169,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,32db33f8e2614cb7d3c30cfa77573ab7,2026-02-12T10:06:06.030Z
|
||||
MKT-WS-070,10.10.2.170,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,3690e9435e87a3b2da8153837763d6fa,2026-02-15T12:51:45.643Z
|
||||
MKT-WS-070,10.10.2.170,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,611f1fb8cca866914714c3f77737e0bf,2026-02-10T10:52:50.728Z
|
||||
MKT-WS-070,10.10.2.170,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,282318771d4e5d5320c9ae9114ba79ef,2026-02-20T15:37:35.086Z
|
||||
MKT-WS-070,10.10.2.170,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,411fe474a0dc3c2098dba83da371b82b,2026-02-19T23:07:28.521Z
|
||||
MKT-WS-070,10.10.2.170,uTorrent,C:\Users\cjohnson\AppData\Roaming\uTorrent\uTorrent.exe /minimized,Logon,True,(Not Signed),0cae3b0d47ed5cbde4e68f091e66d1f9,2026-02-12T17:48:03.256Z
|
||||
EXEC-WS-071,10.10.3.171,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,1ca5480bb6110b7c97a13cd76d5358cd,2026-02-12T15:28:43.280Z
|
||||
EXEC-WS-071,10.10.3.171,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,92c685da727c44a3ce3fa492acfd8a0c,2026-02-18T16:34:25.734Z
|
||||
EXEC-WS-071,10.10.3.171,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,32386481300f754aa2a29feb02931755,2026-02-14T11:21:06.851Z
|
||||
EXEC-WS-071,10.10.3.171,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,9c20b89abe39bf0cc2ac97dab5a996c9,2026-02-14T10:44:52.198Z
|
||||
EXEC-WS-071,10.10.3.171,Steam,C:\Program Files (x86)\Steam\steam.exe -silent,Logon,True,(Not Signed),d06125e2c8424b10e2923b09db7c8d92,2026-02-18T21:27:54.682Z
|
||||
IT-WS-072,10.10.1.172,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,cb7b573fe9140d654dfd153059cec23e,2026-02-20T03:09:22.548Z
|
||||
IT-WS-072,10.10.1.172,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,be04f87ba1c2b005f1c4e6e31f2a65bb,2026-02-20T09:31:17.420Z
|
||||
IT-WS-072,10.10.1.172,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,f99ce66416492b49700e0de7ab8f49e2,2026-02-12T01:20:28.360Z
|
||||
IT-WS-072,10.10.1.172,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,68b05ec7686f503f5acd476d1470e9a8,2026-02-16T11:06:58.383Z
|
||||
HR-WS-073,10.10.2.173,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,0eea9d8033027713fe579dce9fcfc907,2026-02-10T21:27:35.847Z
|
||||
HR-WS-073,10.10.2.173,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,139da91d72859c78c9dfc840ff53fad2,2026-02-11T19:44:37.217Z
|
||||
HR-WS-073,10.10.2.173,OneDrive,C:\Users\gwhite\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,9cd4908a44e2690b00006b62bd71145e,2026-02-17T06:27:11.201Z
|
||||
HR-WS-073,10.10.2.173,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,19b467e51a124b4945dc148fe8410601,2026-02-15T07:02:48.879Z
|
||||
FIN-WS-074,10.10.3.174,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,d0fe1e4b1f64132f0916608a47cd113b,2026-02-14T07:06:20.159Z
|
||||
FIN-WS-074,10.10.3.174,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,75dd67220a772027d6ccb4a16908557f,2026-02-16T04:58:14.026Z
|
||||
FIN-WS-074,10.10.3.174,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,f31dc9eccc4f5f1019a61ab51df1bcf3,2026-02-18T21:54:55.899Z
|
||||
FIN-WS-074,10.10.3.174,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,0834614d2ccd6226f3dfd91f6870e205,2026-02-19T22:41:19.265Z
|
||||
SLS-WS-075,10.10.1.175,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,58a3f3e8a3efd3e794f9d70381478749,2026-02-10T22:13:17.055Z
|
||||
SLS-WS-075,10.10.1.175,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,f16ed7d63800f6e6118dcc03465d70f1,2026-02-14T09:12:21.535Z
|
||||
SLS-WS-075,10.10.1.175,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,5a90e6680bf14a9826bdfbd01e652e11,2026-02-11T11:25:24.778Z
|
||||
SLS-WS-075,10.10.1.175,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e12e3431344420d6a9c0c0c52599fe07,2026-02-15T08:44:30.948Z
|
||||
DC-01,10.10.1.10,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,0917bf6a53fc4de5ded1e219738e4383,2026-02-19T21:49:06.115Z
|
||||
DC-01,10.10.1.10,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,a05c61ef8d7d6aee1ba89f5a6ac96f68,2026-02-11T01:52:42.165Z
|
||||
DC-01,10.10.1.10,OneDrive,C:\Users\bwilson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,e0697fde4e2e8b3d3d08aedfd7154653,2026-02-11T01:06:10.097Z
|
||||
DC-01,10.10.1.10,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,a8ecdd8717e08108a0bc716c66d69d82,2026-02-19T06:25:33.306Z
|
||||
DC-02,10.10.2.10,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,8e46f4877112f92437b541ba7a887e07,2026-02-17T04:48:51.329Z
|
||||
DC-02,10.10.2.10,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,979189e8b0c249d75a1ccc4967cb0988,2026-02-19T06:21:28.740Z
|
||||
DC-02,10.10.2.10,OneDrive,C:\Users\idavis\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,63e689679efbd68b9abb28137a85f930,2026-02-16T06:02:32.762Z
|
||||
DC-02,10.10.2.10,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,e51f19b33cb1292474ddb3722a0b1eff,2026-02-11T12:29:21.456Z
|
||||
FILE-01,10.10.1.11,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,3cfbacc574bcdbe88697a22ac0ad8638,2026-02-15T00:42:20.076Z
|
||||
FILE-01,10.10.1.11,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,a45b31e4fd69a54f2c4d062b4c4eaa99,2026-02-13T13:22:11.398Z
|
||||
FILE-01,10.10.1.11,OneDrive,C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,83fef4984c8e4973fd684d6e6d0ddfdc,2026-02-15T08:23:32.263Z
|
||||
FILE-01,10.10.1.11,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,64d9a6110e88e9e3413066f1924cba07,2026-02-14T21:27:06.097Z
|
||||
EXCH-01,10.10.1.12,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,63cec7c6e35e0026c1720450ceec7934,2026-02-12T18:06:31.325Z
|
||||
EXCH-01,10.10.1.12,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,311bd1adc40a2e9072d76f9d8d33cd7d,2026-02-13T07:12:35.966Z
|
||||
EXCH-01,10.10.1.12,OneDrive,C:\Users\cjohnson\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,2a08fbfdc68efc14c4c2d3897475acd9,2026-02-18T22:57:33.185Z
|
||||
EXCH-01,10.10.1.12,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,d9e8ef9701fcd7dee505470e302b8472,2026-02-19T19:15:19.950Z
|
||||
WEB-01,10.10.3.10,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,f299839d55a02ccba36daeab018698a8,2026-02-12T00:42:42.409Z
|
||||
WEB-01,10.10.3.10,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,87554861f53ebdb14204b0319d543532,2026-02-20T08:53:42.632Z
|
||||
WEB-01,10.10.3.10,OneDrive,C:\Users\jsmith\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,052ad7b9cb17552f54425fbb307afb2f,2026-02-16T15:54:45.442Z
|
||||
WEB-01,10.10.3.10,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,4922ca93a61f0e6e6f7ffaf832301ab9,2026-02-12T18:43:55.289Z
|
||||
SQL-01,10.10.2.11,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,33289dc101881ca32b2549eea1f33fbb,2026-02-20T15:57:36.229Z
|
||||
SQL-01,10.10.2.11,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,bd96f2f5fce3cbcef65388abff27bcef,2026-02-12T16:12:09.448Z
|
||||
SQL-01,10.10.2.11,OneDrive,C:\Users\emartinez\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,b12baa76eaeb4ee8eb515c354662a053,2026-02-13T09:38:17.385Z
|
||||
SQL-01,10.10.2.11,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,f1413bff4520ec6759b1b3679af3fc53,2026-02-12T16:05:43.210Z
|
||||
PROXY-01,10.10.1.13,MicrosoftEdgeAutoLaunch,C:\Program Files\Microsoft\Edge\msedge.exe --no-startup-window,Logon,True,Microsoft Corporation,d10cdc47203a981f69ccd23b24077711,2026-02-15T15:14:35.089Z
|
||||
PROXY-01,10.10.1.13,SecurityHealth,C:\Windows\System32\SecurityHealthSystray.exe,Logon,True,Microsoft Corporation,f3f137e8da7eb37b0ae66fb45a71e4d3,2026-02-10T15:57:58.411Z
|
||||
PROXY-01,10.10.1.13,OneDrive,C:\Users\svc_web\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background,Logon,True,Microsoft Corporation,99800716da8de3befa044253f65bf65d,2026-02-17T21:59:13.166Z
|
||||
PROXY-01,10.10.1.13,WindowsDefender,C:\ProgramData\Microsoft\Windows Defender\MsMpEng.exe,Logon,True,Microsoft Corporation,55e54fe6641547957cfae514eeb50c12,2026-02-16T12:46:38.263Z
|
||||
|
1605
backend/tests/test_csvs/10_logon_events.csv
Normal file
1605
backend/tests/test_csvs/10_logon_events.csv
Normal file
File diff suppressed because it is too large
Load Diff
2606
backend/tests/test_csvs/11_proxy_logs.csv
Normal file
2606
backend/tests/test_csvs/11_proxy_logs.csv
Normal file
File diff suppressed because it is too large
Load Diff
422
backend/tests/test_csvs/12_file_listing.csv
Normal file
422
backend/tests/test_csvs/12_file_listing.csv
Normal file
@@ -0,0 +1,422 @@
|
||||
Hostname,SourceIP,FullPath,FileName,Size,MD5,SHA256,MTime,CTime,Username,OS
|
||||
HR-WS-001,10.10.2.101,C:\Users\jsmith\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,d9398a9cb083e44ca369d0e0a23f3dc821e10a187d83b67ddd039c8ba3a9116d,2026-02-16T13:19:03.752Z,2026-02-20T05:28:53.611Z,ACME\jsmith,Windows 11 Enterprise
|
||||
HR-WS-001,10.10.2.101,C:\Users\jsmith\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,93ff71317e2633263f047c0b9c8e432e31a4d326f622a0e0c0991c0865d85678,2026-02-17T16:01:54.830Z,2026-02-19T13:46:11.397Z,ACME\jsmith,Windows 11 Enterprise
|
||||
HR-WS-001,10.10.2.101,C:\Users\jsmith\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,1529047f20932e75ce4ebf63126bf597c5e8091f4e9ba80da6548e6e67711ad3,2026-02-19T11:04:21.129Z,2026-02-20T02:43:48.243Z,ACME\jsmith,Windows 11 Enterprise
|
||||
HR-WS-001,10.10.2.101,C:\Users\jsmith\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,c0fa69ab4b4182e331fc46c2eaf8905d0224f2aa7547912483e56206e38f8a8f,2026-02-15T19:03:15.373Z,2026-02-19T17:40:13.726Z,ACME\jsmith,Windows 11 Enterprise
|
||||
HR-WS-001,10.10.2.101,C:\Users\jsmith\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,15eccb4149dc36b19e68074454add5769d366db6d05b8076fd05676e636b91ff,2026-02-17T23:01:25.329Z,2026-02-20T12:53:18.490Z,ACME\jsmith,Windows 11 Enterprise
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,bebcb21ef97ab1644782d4f482a7f23d0838f55341f6ddd099088d44ac85b586,2026-02-15T19:22:47.320Z,2026-02-10T12:09:59.146Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,1cb580e4318e25781be96f6d04e7b93fadccd48ee889480e0037fd217f9e2bec,2026-02-20T04:48:06.534Z,2026-02-10T21:45:29.326Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,16eeb42c151ac92527b2e82ea3a7d59dcb390534c4421569cc93e01ea3b29226,2026-02-18T16:11:04.929Z,2026-02-19T05:11:09.976Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,e4d0929c0204f8af6a811845327056a96de7936903409f666f5000021605c468,2026-02-15T02:38:32.076Z,2026-02-15T05:24:05.057Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,d4e62404cadeadd5aba511ceb1407ac2671c65534ea97d34a0babf3b1b520b40,2026-02-10T14:35:15.617Z,2026-02-13T22:49:02.985Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-002,10.10.3.102,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,884679c5c3376b620bbec01042eda5274e7baa3aabfd9acac7a4ec8fa2e71b70,2026-02-15T21:10:18.128Z,2026-02-18T20:16:10.218Z,ACME\svc_web,Windows Server 2022
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,dd940feda7697e0881885f7b832ddd42e4142ca98c6b04f62b337c277e9814d0,2026-02-18T22:56:18.542Z,2026-02-15T02:02:55.852Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,f4c291cc71e45efa2b658d1e870a37e646ecebf7d68ed668b1e5bb675b95b22f,2026-02-11T00:14:51.087Z,2026-02-14T04:19:44.082Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,cc0be4f1276f32dfabbc486d677da37eb0d1568e14bc7ef60a9362f30bb51e3f,2026-02-20T01:23:37.345Z,2026-02-18T02:44:48.884Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,43bc35995ce8bff1ed5600d037d2721f09a2875b35aded4e55184d17c8c34d7f,2026-02-16T23:01:08.694Z,2026-02-16T08:00:13.194Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,c46ac5b57260052d81b8fba68ac79452520042b72863ff2321380a184a0b9e01,2026-02-18T08:11:25.572Z,2026-02-14T21:14:50.154Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,6fd0ae828a07d440cb51faf7d224bf13ea6113e40714d17c42ee805d510700bd,2026-02-15T23:30:09.553Z,2026-02-16T06:58:21.648Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,e77c3ace2e9a5d4733cba737ecd56d481b871a76393082978b2cecab4b55cbde,2026-02-14T15:33:26.433Z,2026-02-18T23:16:32.653Z,ACME\gwhite,Windows Server 2019
|
||||
SLS-WS-003,10.10.1.103,C:\Users\gwhite\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,74701666b6b5491558f3b1ec3d933142bb859b338325835bca90c7822df99be2,2026-02-10T10:07:37.210Z,2026-02-11T05:06:28.050Z,ACME\gwhite,Windows Server 2019
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,9ef2181c95134083db5c5d501df6811caf1025dc59bacb3ae22667483c021aa6,2026-02-15T05:26:07.808Z,2026-02-15T01:49:03.289Z,ACME\hbrown,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,d806c1b1839c662f7094e4564f82f30466dbceadbb0160db19c8077df6e04abc,2026-02-10T12:08:24.672Z,2026-02-13T03:55:55.103Z,ACME\hbrown,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,42dcbd93293a04150360bd533da1014753b5cc62fd92445137790df25b69fe17,2026-02-12T01:52:41.612Z,2026-02-12T04:59:20.851Z,ACME\hbrown,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,cdbcf85c85dff5e23e4661495c409b365d7ee5c44d487adbd08d1dba7af45514,2026-02-19T04:46:17.158Z,2026-02-16T13:32:29.383Z,ACME\hbrown,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,0458dabcf18d2301bcd001a9b14b113c3d86a053493f74447d993915e26ed954,2026-02-20T13:03:52.822Z,2026-02-17T03:20:36.883Z,ACME\hbrown,Windows 10 Enterprise
|
||||
ENG-WS-004,10.10.2.104,C:\Users\hbrown\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,52c722b3b67931d0e175cf13179adb22129c8b446913edf88dd9a9c90dc2ea27,2026-02-14T14:50:13.644Z,2026-02-13T17:25:28.793Z,ACME\hbrown,Windows 10 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,1e48d33e125f502928291ef60cfcef2ead5c7886e9cb02abab5712fdf5f423eb,2026-02-16T14:46:45.919Z,2026-02-10T18:25:21.559Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,26c7966d8aff5454de2850109926194eb175e5a7d731b121a9ff5e5145c2aa17,2026-02-15T11:24:54.902Z,2026-02-13T07:42:13.662Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,fcd8414e6848cf69774dd0d8f6dca14ceccb0a4e7b5691fa2bda5160a886e2fc,2026-02-15T08:14:11.397Z,2026-02-17T02:52:01.305Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,fd843f31fee5420f2ae676614c37327ea068ba3f78d725fa784e44816286e6dd,2026-02-15T16:52:41.161Z,2026-02-19T16:51:39.978Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,388e3ed505d1337e763301158d926ddefc8e724e418d96ee1e5c4e127f56918d,2026-02-18T04:38:19.565Z,2026-02-20T16:51:30.839Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,19f09f4df24fb4cf46992967253a3493261227f34356a4e7c599f338dd4224c0,2026-02-10T16:22:34.591Z,2026-02-12T11:54:32.586Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-005,10.10.3.105,C:\Users\jsmith\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,3c6a7b99a7d093ad3b8ed1d2a08ef2b2ba27c1a8fdeee940d35d1a0f713cbefd,2026-02-15T02:13:29.674Z,2026-02-19T14:57:22.742Z,ACME\jsmith,Windows 11 Enterprise
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,986dcba7adec12e5a478bdc20b77147ad715d4ede257b54243ac156ad0c9db28,2026-02-12T01:14:44.806Z,2026-02-14T19:58:03.091Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,80cb0154c923d605dfdac0131396d194ede1de502ccf46c71e664b80f34aa15b,2026-02-20T07:37:05.802Z,2026-02-18T06:48:03.060Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,5177f9eada05e28d62a7c6e6f7d9ff4d3008372c3bd4a9dc621399daf6d9e3a2,2026-02-17T23:10:16.463Z,2026-02-12T01:17:30.446Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,40589fde7236a2453e709da139c22595b1c9b5b9cf5985e18ebb3eead721ceb5,2026-02-11T18:41:14.257Z,2026-02-16T18:53:17.297Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,7ee1322239b7e4885a25274c69ab7cc21b7e9c85f436285b3df7f9f4c1a01087,2026-02-16T20:37:26.647Z,2026-02-12T19:44:45.379Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,c05b6c3bfdf7d91b5ead63d64ee45fb56b2c94b7a1ca931d27c8d2e0a04cc880,2026-02-10T18:18:33.303Z,2026-02-10T20:49:20.549Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,56ac289d6d1a68ace8ecccd3415e29e0628c03b4280c278eb36b4a1d57eb17e3,2026-02-13T07:59:05.135Z,2026-02-15T13:01:37.121Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-006,10.10.1.106,C:\Users\dlee\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,bfd3229229542781f26bdc4ad5d0fb7004df6f2650fb562c81162a9c935f11ca,2026-02-13T07:28:41.744Z,2026-02-19T12:13:19.445Z,ACME\dlee,Windows Server 2022
|
||||
EXEC-WS-007,10.10.2.107,C:\Users\idavis\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,02cdbff42616de0a0e88a574ec17a88d6d7510cb849c72768efe244b2c123297,2026-02-17T06:37:23.040Z,2026-02-14T19:33:31.793Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-007,10.10.2.107,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,e89cf3db33cdae1593007dae1051159b26c012fd035f3f12b92120fef736c36c,2026-02-20T00:43:45.544Z,2026-02-20T12:11:49.036Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-007,10.10.2.107,C:\Users\idavis\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,609a626819620750e20c363938331a8f7ae997f0ea6f08e45c8c65f241b3e123,2026-02-15T06:22:26.513Z,2026-02-10T08:32:05.554Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-007,10.10.2.107,C:\Users\idavis\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,520dff08006cc179d470d0c97f8bcfba81407acc58f6d1d3fc999582b73743e2,2026-02-12T23:56:30.834Z,2026-02-14T17:03:59.974Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-007,10.10.2.107,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,c4448dd90342e73bc926a48506f5ee668d85595e6a49a6dc837277ee21360020,2026-02-20T05:12:27.254Z,2026-02-10T09:30:26.085Z,ACME\idavis,Windows Server 2019
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,18dab2e9c0603c43780cd3739a62d78c35117dcb142ccedb671d0f5a93d63c97,2026-02-18T19:06:55.581Z,2026-02-17T09:11:51.013Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,8722cc701d5d5b63a2455fe48bbd40232dc307c94f737f32af738a86623bb95e,2026-02-11T11:21:02.231Z,2026-02-13T05:33:28.227Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,de2467de37daa07688b87f7f4b95306c8192ae93cc7cafc4f63938643d7c04f6,2026-02-16T22:59:40.937Z,2026-02-14T20:26:31.932Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,d9c25b2943eb2ba8452caa4549e343c24971da7915bf37ab6f74942a1208fc7e,2026-02-20T09:24:06.357Z,2026-02-19T00:37:53.480Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ea16f8b57122c132454f3effa62cdb557bbe17dccc6d935a94332192c71141ad,2026-02-15T14:41:13.159Z,2026-02-11T17:25:02.171Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,ac7a7b3f0039772af6f43af475c1e3cb2008a6c8124d71691c9858380414bab1,2026-02-16T17:11:23.572Z,2026-02-13T11:42:50.802Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,e267e5ae9ed0a5276d042caf6c853d030a4c800714f680e36e3b5ec675224e1c,2026-02-12T22:58:14.806Z,2026-02-17T13:25:04.377Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-008,10.10.3.108,C:\Users\svc_backup\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,455ab448ad895b4378ac15382f798e0fd7e7ae912469e0b27238553ca6dfc87f,2026-02-11T17:25:46.935Z,2026-02-14T12:21:04.223Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,061958c628f2e622ccb045e884b77d591bd30419625046fdf1fe14676662c9d6,2026-02-10T10:33:57.592Z,2026-02-17T11:18:51.294Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,f52ba5baa778eb33238a1925f87e21b10e02a9a4d2eace637b580e9e9dd4b369,2026-02-15T04:32:42.457Z,2026-02-12T03:37:52.011Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,070032429ec132bfcc7182ad092eeacffbea2dd860a34e225068dbafdb835660,2026-02-17T12:31:06.335Z,2026-02-18T21:27:57.266Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,815d52dbb92cb2ef396795439e7edf5c84a7a6e9402e9b591f75a21b9352587a,2026-02-17T18:26:17.913Z,2026-02-16T01:04:11.210Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,36648d95785e3eedcc18c831c5d031c5ed7e7d849cfb98ec407b04a523cf20fe,2026-02-14T14:15:27.996Z,2026-02-20T10:14:17.722Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,6bfa2d1461989af77eaa98ddac4d93c521ade590aac87d472fac7ef2f973c78e,2026-02-17T10:44:17.885Z,2026-02-19T06:03:41.243Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-009,10.10.1.109,C:\Users\agarcia\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,d8765dcdaadf62ff78aa9b37f9d0d02bc91cf15cd9ddca7e7b24a38af0caed9b,2026-02-16T15:12:28.419Z,2026-02-19T16:20:41.048Z,ACME\agarcia,Windows 11 Enterprise
|
||||
FIN-WS-010,10.10.2.110,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,04ffd30571c246f40d0bd9ae1a2b2665054c5200a12b40ff4d5a3dc449d7e8c5,2026-02-10T10:33:10.480Z,2026-02-18T10:35:46.614Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-010,10.10.2.110,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ec79d0ab01b25d4ea08918a99a87d63e0a762d89789423a77184da8812510712,2026-02-19T02:16:02.384Z,2026-02-20T13:50:16.951Z,ACME\svc_web,Windows Server 2022
|
||||
FIN-WS-010,10.10.2.110,C:\Users\svc_web\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,e14aa1f99c48aa55c7822fb37ec895b1c180be75f0948b7e88f73e9c0ca2b3fe,2026-02-15T22:11:35.355Z,2026-02-18T15:20:51.429Z,ACME\svc_web,Windows Server 2022
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,8195effa5cdcdae87f8ca8917163c052707f7aa2b926870f01b8ebf48bb7f9a8,2026-02-13T09:24:13.934Z,2026-02-16T22:41:56.031Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,cb87187d93f7c0e32e953887d1eb9143378a33b2c38c47839cce86fdc7acc58e,2026-02-19T03:12:06.522Z,2026-02-10T17:42:02.709Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,34602ccb8330dd6ed07c24bbe0f726ba21803a968bcf55e2eef6eee26880ea62,2026-02-18T12:27:49.007Z,2026-02-20T14:56:32.952Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,43e44615245aab40de0f1a59fb09718e7b868f48142861e6da4e223c5abb1d82,2026-02-15T21:32:48.486Z,2026-02-15T14:08:38.686Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,1391176bea5719b42bc1d06a5044544cd155702a91cbd6c4337f5a599159b273,2026-02-19T18:57:02.493Z,2026-02-11T02:47:23.745Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,ee21410df3ff7c166c43f6c4f9281e386d8027d45ff44565e4d4f726a091c424,2026-02-15T19:50:53.847Z,2026-02-15T09:52:49.331Z,ACME\svc_web,Windows Server 2019
|
||||
SLS-WS-011,10.10.3.111,C:\Users\svc_web\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,647138b0cbc9d7b1054ec2bcf7d1f2fcdfd1a1cbd2d972d69b6b09db807cba2e,2026-02-15T16:13:18.192Z,2026-02-10T18:48:46.536Z,ACME\svc_web,Windows Server 2019
|
||||
ENG-WS-012,10.10.1.112,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,c00d6df589e08a33ae27df4ad008bd744fec1c0552047f74885943206c812397,2026-02-15T02:31:02.788Z,2026-02-12T06:35:40.669Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-012,10.10.1.112,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,48a8ccf902ca738fa29eaa647fa2f52f2ad279b69089e8277ddd8a1165544969,2026-02-16T18:03:48.839Z,2026-02-19T09:57:23.609Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-012,10.10.1.112,C:\Users\bwilson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,487392abecedb53dfe46f5bbd0b693b83d58e0462ac5389cfd86410065c0ade1,2026-02-19T06:16:25.477Z,2026-02-11T01:25:17.563Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-012,10.10.1.112,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,5d2e30c6a3ab68be3f1ea1c087bd318fa8aa1e64bf6890e53d1d7f4418225cb0,2026-02-13T08:33:12.589Z,2026-02-10T14:48:42.180Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-012,10.10.1.112,C:\Users\bwilson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,97be611a5089d11f738583bc60c36921106472017ac4c286da2f0ff76042d0ab,2026-02-12T14:49:00.469Z,2026-02-14T06:38:20.153Z,ACME\bwilson,Windows 10 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,82d54b3f9594e4745b373a71247dd9b42eb1f47d8a688dcee015c09735bef60c,2026-02-12T12:21:39.914Z,2026-02-14T13:08:38.645Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,b60223b2fc35fbc64a9583f44b3c8939fd663c8596356fcd33851788923baf95,2026-02-18T05:07:56.774Z,2026-02-18T05:56:24.313Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,d78bf349ffadec141bf780a26fb70b9a301bf82b2c7a059f0d66a3ea5316767c,2026-02-15T07:15:33.441Z,2026-02-12T10:37:09.919Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,96a5721699b403903ee22cc951cc3c7b1726367075ebaa98539581b64a3d8274,2026-02-19T01:08:41.486Z,2026-02-15T14:07:00.136Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,690417f4e18c2bf10e7bfff893f1496a25fe12061ba3d808fd0185abad519f3b,2026-02-10T11:01:38.737Z,2026-02-11T22:58:53.797Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,49d4e93de9156a545e37ab553171d153bd7bec26e701ac3c09ba054ce2a49ab3,2026-02-13T21:48:55.078Z,2026-02-11T16:00:09.468Z,ACME\gwhite,Windows 11 Enterprise
|
||||
LEG-WS-013,10.10.2.113,C:\Users\gwhite\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,3796cfcc33c9df93a14ba9d2c08c443c536ecf1f70c937dab65bc29333334e4d,2026-02-12T20:29:08.822Z,2026-02-12T08:07:00.147Z,ACME\gwhite,Windows 11 Enterprise
|
||||
MKT-WS-014,10.10.3.114,C:\Users\bwilson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,81f824e4da5b29fe9ef7b8ef50aa3368449316ab2fea4e6ea4db76d464f2bee2,2026-02-16T23:50:25.975Z,2026-02-19T08:13:50.505Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-014,10.10.3.114,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,13422dc5abcdb2b5475145accfb6023f12360b77bbc88411765f464d2387a00d,2026-02-19T22:04:58.021Z,2026-02-12T22:35:28.171Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-014,10.10.3.114,C:\Users\bwilson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,819ba3781b023669628466931615fa2bf171dd6e5b474492b1d41d63e8803474,2026-02-14T23:39:24.269Z,2026-02-18T12:46:34.176Z,ACME\bwilson,Windows Server 2022
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,c95605c10d5098140ebc519d4c40265c640c894506d05c24d1ea7b5d82a9b17d,2026-02-17T12:10:11.109Z,2026-02-16T04:59:20.442Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,111b1f4c86c497ad934c8d278f68cb5a092eef4f16ee514336126745032e6a86,2026-02-10T10:25:47.678Z,2026-02-12T15:37:59.982Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,7051d68d067d298f4f05f7e048145415fa1e8c3428cd5658edab8b14a9d93435,2026-02-19T11:13:01.382Z,2026-02-15T15:03:42.696Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,aa8f97a0196b70692db7209df4cc79b5879261e37f8011b64d91120b4aa57154,2026-02-15T12:26:06.906Z,2026-02-12T17:21:35.303Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,2f8ec86d8fd39d4ba65342d74697fcecb2c15fb52c05900006b55e5b2425fb19,2026-02-11T14:46:35.748Z,2026-02-11T10:16:08.063Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,f1728a253b09625f61a30c9cd276a99090b9f17744bbd1f8dd73558e07633c8b,2026-02-16T03:50:29.471Z,2026-02-11T07:24:01.535Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,50969908f5327f9ea9ac63a8161caa60b336720697ad077fca912fd210f60b14,2026-02-20T02:11:25.387Z,2026-02-13T11:39:21.339Z,ACME\svc_web,Windows Server 2019
|
||||
EXEC-WS-015,10.10.1.115,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,cf98a147338f6fa2f32cd9e1a099b3d171763ad04f2d2c2b4d1839da3b9bdfbf,2026-02-20T07:41:51.468Z,2026-02-18T17:19:58.026Z,ACME\svc_web,Windows Server 2019
|
||||
IT-WS-016,10.10.2.116,C:\Users\idavis\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,771fbdb1c45229119f7ef681f28f47b0c5c4b61c45f1266e765b5267357a4cea,2026-02-15T20:04:14.053Z,2026-02-15T11:34:58.944Z,ACME\idavis,Windows 10 Enterprise
|
||||
IT-WS-016,10.10.2.116,C:\Users\idavis\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,5da4871367e1a461135a9ccaf4779c3de3f6719ec3fcd758fc93f1dfb6d2b775,2026-02-17T21:39:32.219Z,2026-02-14T22:01:00.640Z,ACME\idavis,Windows 10 Enterprise
|
||||
IT-WS-016,10.10.2.116,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,38d95d609715bfa54de3d7fbf1d288ad1fb3169a171bcdc6a71859fd3ad78bf5,2026-02-13T10:44:00.956Z,2026-02-15T03:19:31.176Z,ACME\idavis,Windows 10 Enterprise
|
||||
HR-WS-017,10.10.3.117,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,85882d5c26ecae94ae887fda18c5bb0f640eceb2cb757505c113dba15e37af8d,2026-02-15T21:02:39.675Z,2026-02-11T09:10:03.794Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-017,10.10.3.117,C:\Users\idavis\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,e0a93ce4b28ebaaf4027d4bb3fad19eecfdc6db4b19f50757fc6cda5357fb7a3,2026-02-16T04:07:18.864Z,2026-02-11T02:26:40.634Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-017,10.10.3.117,C:\Users\idavis\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,2d5280f8cdb4604ab2a770ce1af09fb96666cfca699a7823ea5aa52ed75b2c4e,2026-02-14T05:03:38.615Z,2026-02-14T06:41:36.091Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-017,10.10.3.117,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,0e01b23720cc521a339dd5a7e436404a509e7490b5b97a1a5bd67f35a622b411,2026-02-11T00:33:48.157Z,2026-02-16T10:08:10.633Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-017,10.10.3.117,C:\Users\idavis\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,843dbd5842d8790565dee1fc5ad9e39c5751bf72427cd2bb3f8fa1bafd07e14f,2026-02-15T06:41:00.888Z,2026-02-14T21:56:27.923Z,ACME\idavis,Windows 11 Enterprise
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,ac21d2a43b1839b133da3a2c2fbc425c6515e634744458e6b0dd6af0226286cd,2026-02-16T13:10:24.302Z,2026-02-13T22:58:29.701Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,c6fdcb03c2f2ca8188ca3d82f1aec2aa9ba3362b8a32901c9f3bfb4a8799a47c,2026-02-12T15:58:59.584Z,2026-02-11T18:53:25.718Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,99f2ed6d3fca6526621caf0a25113596c173901f71bdffa0785510070939d8c8,2026-02-12T19:30:31.054Z,2026-02-18T21:37:17.785Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,318efe09cd2102e6f78a3584aef6ada02ddba772891c5f1fb1c76e2258bf3df2,2026-02-16T22:21:23.145Z,2026-02-19T19:20:53.180Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,f677a56375e6dde90cbac73c3b083b257d77a3a34a205740d996764650705f90,2026-02-11T22:28:23.820Z,2026-02-17T21:39:36.140Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,88f63a1476f73d0f72d31ba8522b9ddc907c02852b3878a02b66f0124a9a1a1e,2026-02-19T15:25:15.826Z,2026-02-16T16:29:51.946Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-018,10.10.1.118,C:\Users\cjohnson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,d20b92c5e27382941c3617b95f24392422cc8c31c4c58f1d471a836af5c9b78f,2026-02-18T17:51:42.704Z,2026-02-11T04:56:47.216Z,ACME\cjohnson,Windows Server 2022
|
||||
SLS-WS-019,10.10.2.119,C:\Users\jsmith\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,e9b9e19b802d99147764ebf9d98fa56c77f1105bb0ede548a1421a5d357a31df,2026-02-18T13:46:01.003Z,2026-02-15T15:46:24.285Z,ACME\jsmith,Windows Server 2019
|
||||
SLS-WS-019,10.10.2.119,C:\Users\jsmith\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,2b04c91127a1428994a3a0a24d00dffc08eaf08afdc9dca3040f80224d99044d,2026-02-14T10:55:22.796Z,2026-02-15T00:29:25.508Z,ACME\jsmith,Windows Server 2019
|
||||
SLS-WS-019,10.10.2.119,C:\Users\jsmith\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,e22e5b81bbef8a44cb5d3b669dfbc67c5e0260092a4fab21c4bad91e16ade656,2026-02-14T00:05:23.209Z,2026-02-11T13:37:55.023Z,ACME\jsmith,Windows Server 2019
|
||||
SLS-WS-019,10.10.2.119,C:\Users\jsmith\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,8ec2632970b87bf60cdbcdebe6142c071bd3b40e5f30fc19eb0c040f7b4ad70a,2026-02-19T06:52:33.651Z,2026-02-20T16:10:33.204Z,ACME\jsmith,Windows Server 2019
|
||||
SLS-WS-019,10.10.2.119,C:\Users\jsmith\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,6fb8e562463b6a1899b5aac434e83f89e59ba3f8258152c86a7b68f3074a1822,2026-02-18T16:18:14.258Z,2026-02-16T19:22:23.529Z,ACME\jsmith,Windows Server 2019
|
||||
ENG-WS-020,10.10.3.120,C:\Users\emartinez\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,6395891ca629a4ebf2436a9241c7159906f310e49e67b132859cee23ec56f591,2026-02-15T11:39:45.307Z,2026-02-14T18:51:35.356Z,ACME\emartinez,Windows 10 Enterprise
|
||||
ENG-WS-020,10.10.3.120,C:\Users\emartinez\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,6ca1fc4c6cfbf1c8059773b5ff3145e8751bbd3031992a0cfc99839878b9bed2,2026-02-12T05:37:54.651Z,2026-02-12T02:40:38.109Z,ACME\emartinez,Windows 10 Enterprise
|
||||
ENG-WS-020,10.10.3.120,C:\Users\emartinez\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,dbc7ddae01120381d222d016fcf7e00f1d82c1757bfbd98dc5386225ed020803,2026-02-12T06:35:08.956Z,2026-02-10T21:01:28.305Z,ACME\emartinez,Windows 10 Enterprise
|
||||
ENG-WS-020,10.10.3.120,C:\Users\emartinez\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,bad743bc78682e6f4cd975900a5d681510c8df07ecbf7a1cf4f2de8e67bc315c,2026-02-14T16:33:22.394Z,2026-02-13T18:55:44.710Z,ACME\emartinez,Windows 10 Enterprise
|
||||
LEG-WS-021,10.10.1.121,C:\Users\dlee\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,af7b6e167afbb3e68674fad243433f1b1e5aaf93bb5a8bbbd523bd20bcfc8429,2026-02-13T07:54:51.526Z,2026-02-12T11:19:10.407Z,ACME\dlee,Windows 11 Enterprise
|
||||
LEG-WS-021,10.10.1.121,C:\Users\dlee\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,f919410ed899e84eb617986a2d6f00c6bda557033bfa1ccb991f45ce6d84226c,2026-02-20T07:09:54.353Z,2026-02-19T08:21:23.376Z,ACME\dlee,Windows 11 Enterprise
|
||||
LEG-WS-021,10.10.1.121,C:\Users\dlee\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,032aefc466cecd1bc8a4193efd0a40610f898f0c7d753f5d878493984301daa3,2026-02-16T12:50:38.668Z,2026-02-17T00:30:17.495Z,ACME\dlee,Windows 11 Enterprise
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,78e97fbb938b97a5a3c1631966d3eb4c7f39f020e28becb5d942f8403af256f6,2026-02-19T15:27:21.801Z,2026-02-18T06:21:16.450Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,cfc244fb6d959c3b1fc9b7f709cb7780e421e306b9e601dadaef1e9a5702eb4a,2026-02-16T14:40:27.993Z,2026-02-17T04:36:11.910Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,0fc975a17dc3189dc70773778c4045869d2494aebab4385c989521fe9a125485,2026-02-12T00:13:03.842Z,2026-02-18T06:23:04.573Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,0e5973748294d2375ee04c55e9f30bee797b5d424011434f061f06f04a1cbc59,2026-02-13T10:15:20.331Z,2026-02-18T17:21:50.586Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,cdafaa8dc66649af20a3b6a9513e89a249c4af8998082753b8379e154d71356a,2026-02-14T12:25:44.863Z,2026-02-13T01:18:19.585Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,a020898201e929b8b0d7ffa4a84471b1c66711dbd226748ba11520fe79874b00,2026-02-19T18:13:54.754Z,2026-02-15T04:39:12.277Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,09b027d9be23b8460d796fba35e4c5f5b93f3982c541a39e0568a69ce3d1709f,2026-02-18T21:22:28.097Z,2026-02-15T14:15:27.038Z,ACME\svc_web,Windows Server 2022
|
||||
MKT-WS-022,10.10.2.122,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,b8b1e706ae8c75e1576cb44a4776443f455b562eae4ea6d79c1744de443301e8,2026-02-11T21:04:14.555Z,2026-02-13T05:41:53.727Z,ACME\svc_web,Windows Server 2022
|
||||
EXEC-WS-023,10.10.3.123,C:\Users\dlee\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,9214af24edab339b3fbeb0b0a2fe06e0db0c588ef59882f934f81abb21d1cdc6,2026-02-11T14:50:24.265Z,2026-02-18T11:08:52.872Z,ACME\dlee,Windows Server 2019
|
||||
EXEC-WS-023,10.10.3.123,C:\Users\dlee\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,1299b1cf1ca8dee8a986afbfae7b50893a658a2d475eca546e1b5e284e72aa52,2026-02-11T08:41:14.303Z,2026-02-19T10:22:56.199Z,ACME\dlee,Windows Server 2019
|
||||
EXEC-WS-023,10.10.3.123,C:\Users\dlee\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,30e2f20a28a550f4223352ce32e0c8ed4395889fb139490d7866e935304868c4,2026-02-20T09:25:00.268Z,2026-02-16T00:44:46.451Z,ACME\dlee,Windows Server 2019
|
||||
EXEC-WS-023,10.10.3.123,C:\Users\dlee\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,1df7c0b9e0cf99a529942fa373a90d444643f48222dde21ac4f6ba157f15b8c6,2026-02-20T12:57:48.564Z,2026-02-18T13:30:26.472Z,ACME\dlee,Windows Server 2019
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,c83aa77f8401a9abe73863022e9aeb69c1cf1db58f20f5d2b7f2f20ee69f0fe1,2026-02-15T16:53:02.632Z,2026-02-15T06:18:37.743Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,5dec0d840e6e3ec6d1b3fc0f2ab23207f7376d5c286480624d84cfa934a46d89,2026-02-16T09:59:04.958Z,2026-02-19T15:33:15.955Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,b36194f85f946b0a61eb4d457e6f582ec223173d74cd4f85217412f468bfbbd1,2026-02-10T13:49:12.100Z,2026-02-12T05:50:06.543Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,25c075acf71a02449f9cada327e0524807f8e314f42324fd03ea90b93a26c882,2026-02-11T22:29:32.029Z,2026-02-11T10:55:22.798Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,2acc5f10d551e72b4566e0045756a13cabfdd5adeef17071c03bd66ad36599a3,2026-02-17T18:53:46.682Z,2026-02-19T15:13:11.957Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,878aefdbabf42578d87499066ea315b103b6c75751bd644883dacffc19221546,2026-02-11T19:02:51.117Z,2026-02-10T20:46:07.104Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,a41cfa659a48a3ce63356be6ac6b90b2ebc0174f77273f14d5ff2315358853d8,2026-02-18T10:19:54.685Z,2026-02-14T23:15:46.596Z,ACME\fthompson,Windows 10 Enterprise
|
||||
IT-WS-024,10.10.1.124,C:\Users\fthompson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,bf68174459da914b86d509e8fe3a5917102371805cd5a2e860685eaf83223a7d,2026-02-17T01:02:32.778Z,2026-02-17T17:05:56.527Z,ACME\fthompson,Windows 10 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,f3400b367a0a4e89f590d942dd963b08c0db304b657147098618d54097531dbd,2026-02-13T12:09:19.195Z,2026-02-16T04:28:04.747Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,6c6adf8336a9ee411cbe60a8c9ffba92008bcf9467b2e1dbf3e4eca05fee5081,2026-02-19T13:04:28.343Z,2026-02-10T16:45:40.445Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,dffc21f55f13de152263d858fc05428768996e461db305aee8eb583c602f5df3,2026-02-12T02:04:02.215Z,2026-02-18T06:25:19.318Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,112e513c68ee2553dcd59684a7ac9076dd53431c8d8f9d58e468f8804f166c3b,2026-02-16T11:03:05.757Z,2026-02-10T19:47:40.837Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,012bd3195f3e0b3b1e388e96e27696f21017eea267d07328e25c56a80f89a9cf,2026-02-17T09:33:59.446Z,2026-02-13T21:04:33.547Z,ACME\agarcia,Windows 11 Enterprise
|
||||
HR-WS-025,10.10.2.125,C:\Users\agarcia\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,b91717b8431f8621847d64b7e096d25462a9fde54e65d58bde68edaa82731999,2026-02-16T02:50:39.284Z,2026-02-11T11:20:41.040Z,ACME\agarcia,Windows 11 Enterprise
|
||||
FIN-WS-026,10.10.3.126,C:\Users\svc_sql\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,f57784da71565fd96d8fb3f6b3163196b745ceb56253569ee54e337259bc45fa,2026-02-18T10:17:41.924Z,2026-02-15T19:11:10.397Z,ACME\svc_sql,Windows Server 2022
|
||||
FIN-WS-026,10.10.3.126,C:\Users\svc_sql\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,8205edb20d13c17f71d807552b722bdbdc37b844e65ae7ad27f759f07e348e6f,2026-02-11T20:08:53.008Z,2026-02-10T18:58:26.359Z,ACME\svc_sql,Windows Server 2022
|
||||
FIN-WS-026,10.10.3.126,C:\Users\svc_sql\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,c6abca91ea20bdc4bd2a206de6e3ae4736e689f599c08884b64d553240bf48ee,2026-02-19T04:58:57.663Z,2026-02-12T10:15:48.479Z,ACME\svc_sql,Windows Server 2022
|
||||
SLS-WS-027,10.10.1.127,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,91c544dd5daa1ed9ad2c1f8ae703da89cbdf0f1e2a5f574f78cec724afe65a34,2026-02-13T02:11:26.259Z,2026-02-13T07:25:54.504Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,C:\Users\bwilson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,9664a3afa2b3ba0c82291a65e2f9234accb735a7afb3b4a2aa5f7b1e69c53867,2026-02-11T23:17:29.928Z,2026-02-18T23:08:53.569Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,C:\Users\bwilson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,3eaad4fb9ce1eba5d4f4a8b345b549633347c2f1fa4556b899067a5ce205f419,2026-02-17T16:14:32.811Z,2026-02-10T12:21:57.016Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,3d1d9fa885481be6b98bde44e4a7d5d0ebba8ef4342785a6f07b0e4d17047d61,2026-02-12T07:27:23.560Z,2026-02-14T01:19:39.909Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-027,10.10.1.127,C:\Users\bwilson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,8262ded2edfded9c4cda58bb529a46be3be60ad648ef7637832cd3e572316190,2026-02-14T10:12:51.874Z,2026-02-11T19:56:26.161Z,ACME\bwilson,Windows Server 2019
|
||||
ENG-WS-028,10.10.2.128,C:\Users\fthompson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,e45eb54de65ca04a9e9499047f9e2f55b430f6d9177a1ed5d578d52da80b4976,2026-02-17T22:57:21.030Z,2026-02-16T14:01:19.812Z,ACME\fthompson,Windows 10 Enterprise
|
||||
ENG-WS-028,10.10.2.128,C:\Users\fthompson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,23cc51d16870ff841109482b189e56c2cbb25eb027208afb7d94c12c07c180be,2026-02-18T11:06:31.245Z,2026-02-15T07:35:13.379Z,ACME\fthompson,Windows 10 Enterprise
|
||||
ENG-WS-028,10.10.2.128,C:\Users\fthompson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,7560bf2e3fd88995bf2717503b9fbe5d37b643fba61a74068482cf0bf5679eb9,2026-02-20T06:16:46.087Z,2026-02-10T20:43:24.291Z,ACME\fthompson,Windows 10 Enterprise
|
||||
ENG-WS-028,10.10.2.128,C:\Users\fthompson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,3bc3fe100e5b9e597e26ac426042708d8cc91d8a703c67983ead7f349b4f13f8,2026-02-17T09:34:19.950Z,2026-02-14T13:48:57.701Z,ACME\fthompson,Windows 10 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,5e6ec662788b1b19c736c148b1942ac5755d2e7cab9ac87a88920fda5a7752e2,2026-02-13T02:28:34.800Z,2026-02-14T08:40:24.282Z,ACME\emartinez,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,db799da2f9c0d2a67d8c51e63acde705329573eec13e2c745f85154a14800bb9,2026-02-14T04:56:48.894Z,2026-02-13T13:52:53.766Z,ACME\emartinez,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,cfe69a439620a18581c26f82e19f3b1094fb68a651aaa9fc96667afdbe7be0d6,2026-02-16T14:50:37.334Z,2026-02-19T20:23:16.204Z,ACME\emartinez,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,dfe3f478183fc7b9b6afaa60232eaae71743b477004910dc3cec605e992b9e9b,2026-02-14T00:44:44.842Z,2026-02-11T18:00:20.836Z,ACME\emartinez,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,b82143dbc3b4c4552e2a8a79ea3b881ecf0fdd83063610d61d1b9f662b7f000c,2026-02-20T06:38:09.130Z,2026-02-13T06:12:01.506Z,ACME\emartinez,Windows 11 Enterprise
|
||||
LEG-WS-029,10.10.3.129,C:\Users\emartinez\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,5165edc673331f8e91ea782af66d022646b0fe711e3cccf30f3b8c1522d89140,2026-02-19T04:48:35.722Z,2026-02-19T18:53:50.138Z,ACME\emartinez,Windows 11 Enterprise
|
||||
MKT-WS-030,10.10.1.130,C:\Users\fthompson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,bc188605ea225c34812fbba2ae8564d2fd361dc3aef73e97c7f6efade6e78cef,2026-02-19T13:59:02.088Z,2026-02-12T07:07:14.562Z,ACME\fthompson,Windows Server 2022
|
||||
MKT-WS-030,10.10.1.130,C:\Users\fthompson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,84a489daa18c2664969f49490c2a334b52246a13e2c4d446b1eb330f302baa55,2026-02-11T13:09:23.409Z,2026-02-10T20:53:38.200Z,ACME\fthompson,Windows Server 2022
|
||||
MKT-WS-030,10.10.1.130,C:\Users\fthompson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,308c8971a8caf7957721f50f4fbfd214f2907cb67f204003e19e097ad7fb6aa1,2026-02-10T18:07:36.618Z,2026-02-20T06:58:27.961Z,ACME\fthompson,Windows Server 2022
|
||||
MKT-WS-030,10.10.1.130,C:\Users\fthompson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,1b85d1263bd84ee7e75b2fd53f8a2c375b544da20111d20c49ba416ce602d3f6,2026-02-13T07:35:20.553Z,2026-02-14T11:29:51.396Z,ACME\fthompson,Windows Server 2022
|
||||
MKT-WS-030,10.10.1.130,C:\Users\fthompson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,e97de97233d9a1e36c0bd8a0700390b930f9b3ba2f87d37219329c8febe5d1e0,2026-02-20T01:03:11.510Z,2026-02-19T17:00:18.211Z,ACME\fthompson,Windows Server 2022
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,e5e6c9b1f9fdf05b2fb49904e2fad7f5dcb0025246bc90b0921c2ec6e4548904,2026-02-18T18:29:25.712Z,2026-02-11T20:44:07.683Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,558e2eefc862b79c26a4795e8764e66fc472a0f0e475924a5506fe19c8302dab,2026-02-13T06:11:23.071Z,2026-02-16T21:37:18.960Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,b1065393ce7921c3df0473685fe041c1b912bfb003ed75856cd181f6ea2fde12,2026-02-14T05:38:11.047Z,2026-02-18T05:27:02.185Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,4bdd583a7b8185bb2b900b41b4933ea4714cb8e9c8e4efd480e51b766952c871,2026-02-14T00:09:51.009Z,2026-02-20T12:03:51.081Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,939db503a0b5f00327ae47fa12c8766c16368e37dbecbd63d385d77e6aa8260e,2026-02-16T19:05:15.953Z,2026-02-13T10:05:22.004Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,4dbbe7f18c26a4cb8adbcb60501860305d9377dbfd7d1ccaf2a4871f2b8888b6,2026-02-10T10:41:53.628Z,2026-02-16T15:44:47.603Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,4abe4f1f36f913fdd83e5e05d04228adb884ba09bdcc79fc0e9cd25a65d8ea4c,2026-02-15T17:00:14.420Z,2026-02-15T14:52:35.294Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-031,10.10.2.131,C:\Users\idavis\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,054944316c8fe1e77b599a92ceb5d3b5cc30880f1570dd1ce983eb38cc7b3e63,2026-02-15T09:50:20.336Z,2026-02-17T06:38:25.460Z,ACME\idavis,Windows Server 2019
|
||||
IT-WS-032,10.10.3.132,C:\Users\svc_backup\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,ace45a6b76fe1479d364204ed11e16e81779456632adb0acdb98c371177cdeb2,2026-02-19T06:52:17.245Z,2026-02-11T06:25:29.532Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-032,10.10.3.132,C:\Users\svc_backup\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,61a0341ddfefb026471b2839190a7fe695e8d04628286bc73b2ecc0965e4dc9d,2026-02-17T01:45:36.259Z,2026-02-11T18:35:57.603Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-032,10.10.3.132,C:\Users\svc_backup\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,a8e5df5fcf2f588bbdcba1c25ce0523d5781691802e7bccb3d28773effe506bd,2026-02-15T15:23:41.465Z,2026-02-19T04:04:38.862Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
IT-WS-032,10.10.3.132,C:\Users\svc_backup\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,54e776fed7cf065c183b41c73aedc29de4d78d5e9ddf21b0165fb2656b85a04e,2026-02-12T05:37:36.274Z,2026-02-13T01:42:39.770Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,7dfcb22b3fe5fcf7a1068ad409fd197562bd993dcb5ef8d5fee9ae1c5a9a0bda,2026-02-18T13:56:57.432Z,2026-02-13T04:52:19.892Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,dc8e9f13c063ebf28785f93c9539f48a6fbdf646425195e1b92bc986169d05b8,2026-02-12T17:44:13.063Z,2026-02-14T05:04:12.879Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,83c6d6cb9494782556bdf79dd1993b27df4aec5ed76e7681f6ac71978b67fec0,2026-02-17T00:25:15.116Z,2026-02-20T14:20:54.809Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,d94a432c86532c08934172cad9a5f0cd077e0b6e6a25d5f037d9a97c2148b314,2026-02-19T05:44:42.767Z,2026-02-11T06:51:26.667Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,3df492e0121556726d79dbf0fa4dfe3d7945e9163042696d317fadb88f605111,2026-02-15T06:08:00.698Z,2026-02-11T13:01:25.568Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-033,10.10.1.133,C:\Users\idavis\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,1eec1df9f1bb478acd7b96e42d204523c2699ae13b63114384f1aa0205719f33,2026-02-12T11:16:46.815Z,2026-02-11T04:15:43.242Z,ACME\idavis,Windows 11 Enterprise
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,5ea5cc6f716f93998f5e8ae7e96e11dde920bb69e43ecf84f20bb75a46213822,2026-02-17T06:10:17.311Z,2026-02-13T18:05:07.728Z,ACME\jsmith,Windows Server 2022
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,a711c5cc83d5427dd34c75fc9ba7921ab91618aa5a61f8f7fe8dada92bb559cd,2026-02-12T13:31:38.992Z,2026-02-15T01:10:21.926Z,ACME\jsmith,Windows Server 2022
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,a8c207730c61bb964f99e6887ad46adc6343993eede4b20852de5574a567643d,2026-02-11T21:30:04.245Z,2026-02-19T13:17:55.999Z,ACME\jsmith,Windows Server 2022
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ed2f9de53e806c07c8d5f389ebfc04d0d0b6be3019266fd2307a1361a74130d8,2026-02-15T01:28:25.600Z,2026-02-18T14:35:15.979Z,ACME\jsmith,Windows Server 2022
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,e3a3977a17f3baaca4e97a0a37535b34fbdf51e81a267c825739a341a47ccb6d,2026-02-11T14:53:18.458Z,2026-02-19T17:41:57.822Z,ACME\jsmith,Windows Server 2022
|
||||
FIN-WS-034,10.10.2.134,C:\Users\jsmith\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,67f8521ede4cf808716104a5d755bdd71fc0d8ca21b1e189e78e423a6417df3e,2026-02-11T11:41:52.692Z,2026-02-13T08:58:56.276Z,ACME\jsmith,Windows Server 2022
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,c8c97a3fe47aad6212c12959572a31fb3e4b69241d32a9b2961f230d89071128,2026-02-12T12:51:21.276Z,2026-02-10T23:32:58.010Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,e779ad8864325055b8c1d8a112f1f84dce970ccc54d9e908ff289d7c5bd896ce,2026-02-11T14:19:46.425Z,2026-02-11T18:54:50.469Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,9a096ee99dffeace622915c7a8dabe5e3549862be4f27edbe3a275310496e8bc,2026-02-16T06:46:54.792Z,2026-02-12T02:50:04.974Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,52dc2715a00ea5ed0f688b1849d592daa25d0238865ac3a564a9c1819c0855ac,2026-02-20T05:09:27.577Z,2026-02-13T01:12:34.235Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,9a44afb82aed4e6be66a79275a22e5aabd39e3d2c902c14c5208f14508d24a1e,2026-02-19T02:51:24.872Z,2026-02-17T10:28:35.146Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ee6710f2a83d86a77d9f1c5997fe4bcd44da0cfc94d7f6a9afb1bee66ccd6434,2026-02-19T18:42:44.310Z,2026-02-13T21:12:09.751Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,809a881510d282551e8c40a05d5d44f32005dce65c7718cad210b38900db41e3,2026-02-18T05:38:36.021Z,2026-02-17T10:52:29.239Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-035,10.10.3.135,C:\Users\hbrown\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,9113a902ea2d6046ff9e2217a0f6526def8eb1390920c752f7bcadebc536e8f0,2026-02-10T10:41:39.118Z,2026-02-15T02:26:59.814Z,ACME\hbrown,Windows Server 2019
|
||||
ENG-WS-036,10.10.1.136,C:\Users\admin\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,1bd13af9bdbdc08fb38d5204c6b6ef474151989a6a8636364ee42f869ca840be,2026-02-16T15:14:21.074Z,2026-02-15T12:25:14.086Z,ACME\admin,Windows 10 Enterprise
|
||||
ENG-WS-036,10.10.1.136,C:\Users\admin\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ba3801328dd87b02d93af8fac334848cceaa87d94c93cb6e4cdaa8683ae32562,2026-02-14T01:00:06.403Z,2026-02-20T09:09:35.306Z,ACME\admin,Windows 10 Enterprise
|
||||
ENG-WS-036,10.10.1.136,C:\Users\admin\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,fb9723037b217327edcb6f61c85840cd472c0c4e3a53deabb783df2f8bbd9d51,2026-02-10T14:53:12.870Z,2026-02-16T20:12:46.600Z,ACME\admin,Windows 10 Enterprise
|
||||
ENG-WS-036,10.10.1.136,C:\Users\admin\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,05f0f3504ae99d31286df3032f3c169c8d7d18cb286487e8adc2719809f45f10,2026-02-11T08:17:02.173Z,2026-02-13T02:49:48.080Z,ACME\admin,Windows 10 Enterprise
|
||||
ENG-WS-036,10.10.1.136,C:\Users\admin\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,c6204f53c0b2a92aac50c49874bd3c3396ce84a4e7245eeaf431357cd6066a09,2026-02-19T08:27:29.801Z,2026-02-12T03:12:57.119Z,ACME\admin,Windows 10 Enterprise
|
||||
LEG-WS-037,10.10.2.137,C:\Users\jsmith\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,11d84aba9b6fb92692c6c3877d7ed3f6d8e9e6bfe02176f1c90b429972bead4b,2026-02-16T16:43:28.875Z,2026-02-11T08:21:13.326Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-037,10.10.2.137,C:\Users\jsmith\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,4bb17fbc2388d976a74dde32e999e1938bf05b96ccacd344536ee83fcf9f54fe,2026-02-20T01:03:42.410Z,2026-02-11T10:16:41.667Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-037,10.10.2.137,C:\Users\jsmith\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,4fd19b36fb2125c9b61bb2e6996dba2e2b07b81eaf40e0e69d09c52a7079a14f,2026-02-18T17:59:20.902Z,2026-02-12T09:24:23.517Z,ACME\jsmith,Windows 11 Enterprise
|
||||
LEG-WS-037,10.10.2.137,C:\Users\jsmith\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,e86344507d08dec44296bdf977d4c8d0a670875071bf56e23b5fa292ffb50649,2026-02-17T06:33:11.969Z,2026-02-14T15:11:35.189Z,ACME\jsmith,Windows 11 Enterprise
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,8739271a457daf8f41f30037e1c1ced0d54c95fe59389991c117a0f8453ce868,2026-02-15T12:13:23.608Z,2026-02-12T08:42:46.245Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,d1342ced6690422872780de686c8e7494954935308ba8f7ae7ddb9711a3396b0,2026-02-19T07:48:51.901Z,2026-02-15T08:36:20.479Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,6539e9b3c1abaca85a289d05ca4586f23fac9d93d2323931e53a619b52bba9b0,2026-02-17T15:39:34.395Z,2026-02-20T05:29:11.517Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,3fb656a44717a35a7c0be9a901365af909e24b7c425d927552b096fc7167ec4c,2026-02-11T12:46:09.509Z,2026-02-18T05:47:14.564Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,9063b069d8db3fd36bb61c02fcd4341632897245d9b0749108e7d37dff081bed,2026-02-15T14:02:37.289Z,2026-02-18T16:56:33.936Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,0d09a89c8c062c535072505ab85c53c406b90ada55f2bc1779169081d7f2588c,2026-02-19T04:47:12.878Z,2026-02-18T00:54:24.218Z,ACME\dlee,Windows Server 2022
|
||||
MKT-WS-038,10.10.3.138,C:\Users\dlee\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,11203efe9474b9ba0ef4a03b9c28759d0160e3d9d93588a06d478c36f874c65c,2026-02-20T02:29:49.078Z,2026-02-19T22:21:47.535Z,ACME\dlee,Windows Server 2022
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,826823ebcf6461b669d6dfcf4d4e495d5627d79d6dc032dda8fe3c2c48fcc50a,2026-02-20T00:00:12.630Z,2026-02-15T11:27:53.682Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,97b7f6c064e5b62490dc562001d0e2f95b7d8b6e7a11f78e5921e000c5e5f9e4,2026-02-17T18:26:33.219Z,2026-02-15T18:44:39.015Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,34c482eab608dffe2f6758f46a41d9d937edd67dce700f017558626b13cd85fc,2026-02-19T12:05:29.960Z,2026-02-12T11:47:29.812Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,237048f3f8186d58b7bca02c01da3f5a90fca244fcd60e46111863b29c4cd555,2026-02-14T18:36:48.164Z,2026-02-15T21:38:26.531Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,a5ec502981598ffdab22820409a2e4fd7017cfb9d9a01bfc69f7a946f880d021,2026-02-17T06:22:57.044Z,2026-02-16T07:39:30.819Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,1dae3108a52487125d94622cf48258726b235c252999bdfed3ccaa91bace0215,2026-02-18T23:16:27.662Z,2026-02-14T16:25:39.893Z,ACME\svc_sql,Windows Server 2019
|
||||
EXEC-WS-039,10.10.1.139,C:\Users\svc_sql\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,cb5657ca38b76d25085837f60deccd56569b22c7754e9a929cae3ac4b56c643e,2026-02-13T11:50:27.341Z,2026-02-16T00:45:44.228Z,ACME\svc_sql,Windows Server 2019
|
||||
IT-WS-040,10.10.2.140,C:\Users\svc_web\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,62bbebecfcdb6b0e658c0503f21acbf4522930206e7e804e4df1bb50d529c025,2026-02-12T05:52:16.406Z,2026-02-20T01:56:44.308Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-040,10.10.2.140,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,559a434bad4fd1e7ac1d2219a5e796f6a528b8d0ae9a3bcf3a4c2710389a57bb,2026-02-15T12:26:38.075Z,2026-02-13T19:50:04.532Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-040,10.10.2.140,C:\Users\svc_web\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,e7aa387015616f0568607781a009fefbc244025c7673c862fe73abbbbf2f250c,2026-02-10T10:15:46.451Z,2026-02-14T14:07:36.291Z,ACME\svc_web,Windows 10 Enterprise
|
||||
HR-WS-041,10.10.3.141,C:\Users\emartinez\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,64c9e9427ec80e30136f0faa959a1daad692bb35973496202ccd6084b6d57e7d,2026-02-14T17:38:15.014Z,2026-02-12T23:50:02.998Z,ACME\emartinez,Windows 11 Enterprise
|
||||
HR-WS-041,10.10.3.141,C:\Users\emartinez\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,b0ca056803ad17117b280211794722eb5de45ddfa57b35e09bb4ffd2110cc0db,2026-02-13T03:12:59.189Z,2026-02-10T09:56:05.071Z,ACME\emartinez,Windows 11 Enterprise
|
||||
HR-WS-041,10.10.3.141,C:\Users\emartinez\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,6bcd09fa9f6e067c94dd7157e87730e622b18af8b4ecfb0f7e783af146738e53,2026-02-11T16:32:02.524Z,2026-02-18T03:07:54.319Z,ACME\emartinez,Windows 11 Enterprise
|
||||
HR-WS-041,10.10.3.141,C:\Users\emartinez\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,2c65e1bc636fcb720f680b6319ed9c4b41ef473ba6ff493ecacfdb04741e4ffd,2026-02-14T15:44:58.668Z,2026-02-17T22:42:21.245Z,ACME\emartinez,Windows 11 Enterprise
|
||||
HR-WS-041,10.10.3.141,C:\Users\emartinez\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,5c5f013d7cc755997654fb94b39516106c14f9ec40eebe465751db3231dfa7cd,2026-02-12T11:37:53.268Z,2026-02-19T10:25:06.657Z,ACME\emartinez,Windows 11 Enterprise
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,a4da7990e3d3a19d0198a2b92d8be7e9083031fe8ee5648c73fb46441c1aa43e,2026-02-15T07:47:32.254Z,2026-02-16T00:08:09.602Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,69cd9b817a3e8b48a586b2b2660be5551d926a12a6f552403579aab03bd362d2,2026-02-11T10:27:22.817Z,2026-02-17T22:43:10.085Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,7c4de6d7b583d8f253040ea6415d825c86bc2e6e6eed53b2ec83cffac3f6c95c,2026-02-18T07:06:06.113Z,2026-02-16T07:02:42.593Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,a40c352351e3f1959edbea4ca25bf1032d0b86026d35cc461da1eaf6930acde6,2026-02-17T04:24:32.715Z,2026-02-20T09:33:18.546Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,3f37dc9176e2a2f2aee12b69f1536b7c2e69773cd606f7b29385f1e8ae57b926,2026-02-17T12:50:15.529Z,2026-02-15T01:43:18.692Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,5dde7ae84a3807d2864a1de6fb74d3a7cb97901109d1ed6bd3830a5eccc8f751,2026-02-14T00:16:23.810Z,2026-02-18T14:21:01.599Z,ACME\idavis,Windows Server 2022
|
||||
FIN-WS-042,10.10.1.142,C:\Users\idavis\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,e1a764ecd9ecc4dea8f35392cedc76364bb8e8c7f631e4fe56471059f466d86f,2026-02-15T08:12:07.452Z,2026-02-12T12:23:53.101Z,ACME\idavis,Windows Server 2022
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,caf49344f41486a2f7ca444363309f97de2794f0e28519077b2c8e97a09d5747,2026-02-17T12:01:21.401Z,2026-02-10T14:03:05.915Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,4b0cb099ef0e43921668ffeb7c10413ef57c89f221045d423009a2f17b930aad,2026-02-17T09:10:05.692Z,2026-02-19T00:56:23.555Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,de9530ae9a96239a45653fb2c4e8c39c1422ef63d320258f1e8ec933c502fb1a,2026-02-13T03:10:39.548Z,2026-02-19T22:53:31.688Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,ab3cc4f79938850d79f27c8fd131e523d1fb512299209a97855b30dfe29f0b26,2026-02-12T04:51:39.336Z,2026-02-14T22:30:22.757Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,725be315101693ae4da65d9178e6c0b18e9fa2dc03c8856303030adaf6fbc12d,2026-02-14T11:23:51.453Z,2026-02-16T18:42:41.012Z,ACME\hbrown,Windows Server 2019
|
||||
SLS-WS-043,10.10.2.143,C:\Users\hbrown\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,90864179c571f1895d0ac072247d70dae30b4625b33aa39a5a75e2b2e48a9934,2026-02-16T06:59:13.911Z,2026-02-13T15:54:31.046Z,ACME\hbrown,Windows Server 2019
|
||||
ENG-WS-044,10.10.3.144,C:\Users\svc_backup\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,b7f35cf93d7ccbda6c74c571e4a54b568d749525b9f9d580b4e0472c7672ba21,2026-02-12T00:40:35.817Z,2026-02-20T14:47:37.629Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,C:\Users\svc_backup\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,3fd6431876135c6847283dc252799c757ef7f2fb8195c22cd90386c56f814102,2026-02-19T03:43:18.491Z,2026-02-17T13:06:36.485Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,C:\Users\svc_backup\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,0d8d2f9d3da475161c770f781e8374b86ba629751a7bfd28d053762e14a9fa0a,2026-02-15T07:45:47.271Z,2026-02-20T15:37:22.446Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,C:\Users\svc_backup\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,f6a7a23dfd0ff30f220ea3ef043b452d767b662d972e11f542befa15a489fd20,2026-02-18T11:44:50.893Z,2026-02-18T23:28:09.534Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
ENG-WS-044,10.10.3.144,C:\Users\svc_backup\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,7f3cc0419d9f1bab44faa1a49ab31e292d5a604eac29c1e15f94c844d23a354e,2026-02-16T05:30:17.569Z,2026-02-10T21:40:58.118Z,ACME\svc_backup,Windows 10 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,8e82c9bd05ccd7a81a3b560c737042cbd9336ae03ed701845613abe0d59a299f,2026-02-13T05:29:24.014Z,2026-02-20T00:29:15.903Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,5e73d77eca2387c2afa168cf8056f28fb2dec916546b428ab50ac811f4cefa21,2026-02-11T01:10:37.466Z,2026-02-16T19:58:39.822Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,e87e043453e02569e0bba0cdef4b336d8d8a69a60d52dad3132e3990b57cedce,2026-02-16T08:46:28.014Z,2026-02-17T21:58:04.518Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,1009e17d12990f95d7fc5bb91fd9c8f0e475feb06265e6766a0e0f39b9531456,2026-02-10T15:29:09.939Z,2026-02-20T17:53:35.951Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,cdb7380059530e0c6d76a5b780034081b1513aa95de751d82e5a945d225a982f,2026-02-14T13:11:37.245Z,2026-02-19T01:32:57.232Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,406b1b9785ca1dad5468288172e147aeeadfd279d90aa8a81e94ac04ce12f63d,2026-02-11T15:39:29.933Z,2026-02-12T12:06:15.932Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,7260f94b893d531df361dd6f5c1f282642bbda812e21e3ee0375164274638b54,2026-02-15T23:15:39.620Z,2026-02-14T04:49:55.937Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
LEG-WS-045,10.10.1.145,C:\Users\cjohnson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,4eeea26c4105f7c956646ef3ec9045a88d82ae941daafd7170df268626d1c283,2026-02-10T20:28:13.454Z,2026-02-16T05:36:55.749Z,ACME\cjohnson,Windows 11 Enterprise
|
||||
MKT-WS-046,10.10.2.146,C:\Users\gwhite\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,15c8638a45bdd673d3ff7c95171a0eaf422a4cca8ded7e91f6e9dbf2d2295aba,2026-02-15T08:09:33.058Z,2026-02-17T22:57:07.760Z,ACME\gwhite,Windows Server 2022
|
||||
MKT-WS-046,10.10.2.146,C:\Users\gwhite\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,3a33ce0e2967b1d2d9905d03f55b632d97e802931bf8593e9a45d69225d57a77,2026-02-20T07:25:37.501Z,2026-02-13T04:43:40.976Z,ACME\gwhite,Windows Server 2022
|
||||
MKT-WS-046,10.10.2.146,C:\Users\gwhite\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,c21407bc7559f5ce75bcc050c946c4c4d266a4ac9d147e84a66bf174cd19645b,2026-02-18T08:52:58.045Z,2026-02-13T13:13:19.531Z,ACME\gwhite,Windows Server 2022
|
||||
EXEC-WS-047,10.10.3.147,C:\Users\svc_backup\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,8ca46a0fd1f8749083aa7f989b5fc735df042fbd8a07656dcf7e66af935b3274,2026-02-13T16:41:39.060Z,2026-02-18T17:15:07.175Z,ACME\svc_backup,Windows Server 2019
|
||||
EXEC-WS-047,10.10.3.147,C:\Users\svc_backup\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,91d608b1d94a04b68d9e9668f23fce348a333baa9e1831ea526475bf381ac83e,2026-02-12T07:19:38.065Z,2026-02-19T15:24:54.241Z,ACME\svc_backup,Windows Server 2019
|
||||
EXEC-WS-047,10.10.3.147,C:\Users\svc_backup\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,7b243e08bcb74f6345e753c91bf0f66e96fc194f1b4ec87b00c491cc16b3325f,2026-02-16T05:52:30.816Z,2026-02-12T03:50:42.145Z,ACME\svc_backup,Windows Server 2019
|
||||
EXEC-WS-047,10.10.3.147,C:\Users\svc_backup\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,22d31ee74d58df4963f98cda8110c4c8209e26433e3940f1db0a59d6e3260638,2026-02-12T23:31:17.286Z,2026-02-15T22:26:40.326Z,ACME\svc_backup,Windows Server 2019
|
||||
EXEC-WS-047,10.10.3.147,C:\Users\svc_backup\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,4bdaf635205a763f2327146524cc008105891b14a3c8311fe8e46fbbc66443e0,2026-02-16T12:09:02.109Z,2026-02-15T00:20:32.421Z,ACME\svc_backup,Windows Server 2019
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,15d008e3f556e820f7f18bdf44d4bd68c8c6ebc7aa234acce6c2e9db13bbaa48,2026-02-17T15:29:47.826Z,2026-02-19T03:16:38.437Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,4854aa44d8e59d34e4011dee8a4f6b826566c8f09ad2b3517b41fcaabe53ba44,2026-02-13T22:28:53.872Z,2026-02-14T19:43:15.171Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,0561c5e25e2a4e394a00c4d04ace0e58fcb82370f757818acdc29a97f1315230,2026-02-10T22:58:17.984Z,2026-02-13T04:40:38.646Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,ad56dc8bd5f4e3a7244942969d14a5ed007564afd8234bc41b749a9d6ef94625,2026-02-14T01:28:03.196Z,2026-02-11T05:01:23.410Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,f45a8ddb81dcea19037d3e99421bade1397085f15afda9d8fd3d79e2509625c0,2026-02-13T22:23:36.095Z,2026-02-16T19:37:27.832Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,b11beeeb39c2bbede4e6a3fc15062c3883c71a7b4ebc880f8e860e2565bec245,2026-02-17T23:56:29.235Z,2026-02-16T15:53:44.965Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,51f6861479b42e6e1f286a6b360e65d6ab295b3a9d38b17440edfcfc4ef75bbf,2026-02-15T15:04:02.380Z,2026-02-20T08:26:44.056Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-048,10.10.1.148,C:\Users\svc_web\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,7210e00d9ff6868307df0eeb3788de0b2ae9ff946f111368b46d42da243514d1,2026-02-10T20:28:38.011Z,2026-02-16T05:11:46.785Z,ACME\svc_web,Windows 10 Enterprise
|
||||
HR-WS-049,10.10.2.149,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,591763af5cfc6bec51fdf942dcb5bba11a1881f7f4d8e09ec57b95b8868c8ad7,2026-02-19T12:07:32.972Z,2026-02-11T17:02:36.653Z,ACME\svc_web,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,e94f7dfbc335b2f4bffd2a908afba84b2e8ff31ca1f556da6239a01ddd487f19,2026-02-15T07:04:52.369Z,2026-02-20T01:34:51.495Z,ACME\svc_web,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,41f1e49f2b8afbb450447b5a11ce7c322467db266383e67382050465390585e7,2026-02-17T10:22:35.991Z,2026-02-15T16:58:14.855Z,ACME\svc_web,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,C:\Users\svc_web\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,da4382304451637b3a9eea68afadcfa74d975af4db4a9bfddb477e38d4246d3f,2026-02-13T17:53:29.182Z,2026-02-14T15:11:33.519Z,ACME\svc_web,Windows 11 Enterprise
|
||||
HR-WS-049,10.10.2.149,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,93fea86c2009fb57c3b01dbe58e63b5cdfd43470a41a160fe36b02921027be54,2026-02-20T16:27:37.178Z,2026-02-16T16:57:25.343Z,ACME\svc_web,Windows 11 Enterprise
|
||||
FIN-WS-050,10.10.3.150,C:\Users\hbrown\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,a24d40cd3df2bf6f7bbc3aa5cab22829a3ac957dc5a1454ca338dbdf2def6bf5,2026-02-17T07:03:33.301Z,2026-02-10T14:26:13.260Z,ACME\hbrown,Windows Server 2022
|
||||
FIN-WS-050,10.10.3.150,C:\Users\hbrown\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,8b6213801b49ffee0f1e75f3dbb6669c40a61fa39db745127f72082e80e047ad,2026-02-14T10:59:49.346Z,2026-02-15T16:23:02.229Z,ACME\hbrown,Windows Server 2022
|
||||
FIN-WS-050,10.10.3.150,C:\Users\hbrown\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,3d909be6cfcd977f62b7e5e27e340c068be43e11e6ea02998e789d8483bf1699,2026-02-10T15:00:35.773Z,2026-02-17T16:43:42.684Z,ACME\hbrown,Windows Server 2022
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,dfbd05289c931ca09ece378fc352ca7cef2e942f0bc272243cb82ec81cdfcb3c,2026-02-14T16:36:33.359Z,2026-02-16T08:13:53.158Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,5b11223971d332a81eab4a5d19388086710d772a6df25ce155a5ed027d0b84ad,2026-02-14T02:42:22.927Z,2026-02-12T01:38:45.881Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,28f4b935f30de5efca6703ccd92960182250cb7bf4a5c748d99b9a42895b53a0,2026-02-13T11:50:44.278Z,2026-02-13T15:17:01.703Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,5724811fa9ef2397a6048874f621bc1e75ff9050e4901271175fd87ba83cc306,2026-02-19T03:11:32.086Z,2026-02-10T22:27:32.373Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,3ee51ef26fad03eb6cc0492b70726fca488209929a82018a87896782187d1588,2026-02-12T01:16:52.307Z,2026-02-14T04:23:02.713Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-051,10.10.1.151,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,cdb40d12da5dd8ccda9c391aeca91ce3b7a62015d9e0de8e8b244ed5a22c0814,2026-02-13T21:31:26.399Z,2026-02-12T12:21:12.074Z,ACME\bwilson,Windows Server 2019
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,20f04fa1378f3605b1f05eb21a5b39947107f5bc0451fd8fd14b1261eded33d7,2026-02-16T05:59:03.718Z,2026-02-11T01:10:17.575Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,bc41d47c0e020f38f171c4e7bb05d6a36f82cce5795dbefb9d889f1ab8a98092,2026-02-11T18:58:26.405Z,2026-02-19T03:59:09.719Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,f3a9bb726eb6764a7d6979caab7cc1f976d2294c14dc58ab65a77b624885517f,2026-02-15T15:33:14.983Z,2026-02-15T21:28:39.909Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,8dfcfd541f02f8743a7fba9a21ab9c11017843174e9fe31557561e19154084d5,2026-02-17T13:03:01.811Z,2026-02-11T04:11:46.132Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,b07700109e195c26035923a978783dffc552bd564d5441c05c431d11862f268c,2026-02-12T00:47:41.334Z,2026-02-18T05:36:57.669Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,4fb0ef847ff8dc1b3853694111af672c1e1666b68dad3e2b2aa0aeca16a169bd,2026-02-17T10:26:40.881Z,2026-02-18T23:08:43.836Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,4274dd6afe5faa8353b2a849de4bc43d17e394d8724db0fef46e692977ab3db5,2026-02-18T09:06:30.024Z,2026-02-11T00:09:19.656Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-052,10.10.2.152,C:\Users\bwilson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,2f0e1a60ae27dec2f23616d01400e717f93911c9eb34e6db99459ce4281944dd,2026-02-18T14:50:37.907Z,2026-02-17T11:14:29.469Z,ACME\bwilson,Windows 10 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,5350bd0171d8593cf11cf439d51d9ec22db8f4959b995fbfc80c5d410e454286,2026-02-16T08:45:23.209Z,2026-02-13T04:40:16.458Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,e2dbd309766a659ae2850e73eaf59694cc7992ee70860a03a1bdb6bb6830f188,2026-02-17T20:13:47.658Z,2026-02-19T03:12:54.071Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,5cd2dcf247781d5859f7d96b94c9274128ce20ae78eb45e479dba478011b9e10,2026-02-13T05:48:54.994Z,2026-02-15T16:00:26.197Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,9365ffa4a021c0873ea17f94206df851dd699d574029ac0ad37d7f42f9c36335,2026-02-19T10:33:10.631Z,2026-02-19T15:23:55.632Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,058d8d26619cc43ae1951ddb9c8c7dbef56e24e6cc3e9c9a12e775cb7a304b51,2026-02-12T01:34:05.741Z,2026-02-15T18:54:22.756Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,aa8b539ee3686667944d7af5d60400dffde395a011c0882adaa0e36c5b0d22a3,2026-02-11T08:54:43.639Z,2026-02-10T19:17:25.296Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,e82d92fba2a1f8450d6ce8d1765203a5f353e5f0afb5cfdca5e2ada2ae8ce974,2026-02-14T11:40:29.934Z,2026-02-19T09:41:07.164Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
LEG-WS-053,10.10.3.153,C:\Users\svc_backup\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,da28550a9beaf9f77c96e71311967b6f21a308f9d89131594d78837debf20d6d,2026-02-17T13:02:43.678Z,2026-02-11T21:11:03.662Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
MKT-WS-054,10.10.1.154,C:\Users\bwilson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,980d5af4c6cbeb4d7daeb5f688b25c1282ae1e69260b3592e64fedd3cbbb7797,2026-02-11T06:19:47.914Z,2026-02-12T20:32:38.682Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-054,10.10.1.154,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,3617f5180f5224f1cfa5c2ed5d898e106613182bf1585c883a5722bb4f56fc1b,2026-02-14T13:55:55.352Z,2026-02-11T09:16:10.078Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-054,10.10.1.154,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,7b0e1576e1418253a6ac7a1d82b152bd6fedffbfd02a9256af3a1b3cb5a40537,2026-02-12T08:36:19.447Z,2026-02-14T01:11:58.780Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-054,10.10.1.154,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,07dffb3558eb2d02d7ad1109a4ca9fcc29c690153e3cc0d513171e5fe1c15b01,2026-02-13T06:00:43.915Z,2026-02-10T16:44:07.885Z,ACME\bwilson,Windows Server 2022
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,3af6a07345316a9f73f1424324c3374b8b30226c90068c6325d22f90b0add79f,2026-02-16T21:08:26.488Z,2026-02-17T21:25:46.277Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,782dc134b0b8e55b412d780c0b3dfcc5d0998f312f7f319d57ba8e39e06cd8e8,2026-02-15T04:58:46.698Z,2026-02-11T14:37:55.486Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,346cc8f38df4a795b8c4497f00cf3bb190020ef0f2d6004040e1056ab5549a5e,2026-02-12T20:41:06.567Z,2026-02-11T09:58:00.895Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,9ed3358e394cad72a925efaca08c9ac362e6dd66e9484aa8b8aa6b0980f828c7,2026-02-14T22:27:43.775Z,2026-02-18T22:29:08.888Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,5350debd35e21079ef38f1d3900fce18a5995cdce538c093e74436ca471e09a4,2026-02-14T08:11:54.017Z,2026-02-16T20:51:46.162Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,9c76320c13a88cf7a63ada8166f90ff4a28ba05a393e9f8f6cab48a33126cc0c,2026-02-16T13:01:01.897Z,2026-02-20T17:00:09.009Z,ACME\idavis,Windows Server 2019
|
||||
EXEC-WS-055,10.10.2.155,C:\Users\idavis\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,3f69af120a3550fed16c34ee4d69d25a84255b740193aace6b16f686d67354b6,2026-02-14T00:21:13.260Z,2026-02-16T14:01:10.433Z,ACME\idavis,Windows Server 2019
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,f3f34da2997d55930fb150e4dad2841cee5cf927258bb49305a84b5be9bb4665,2026-02-12T18:19:04.587Z,2026-02-13T12:13:55.926Z,ACME\hbrown,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,d0687e11d73598ae20792317456e89268e739c08c5b066acc5fc056669cef515,2026-02-12T02:06:08.156Z,2026-02-10T15:27:58.479Z,ACME\hbrown,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,f19c851bdb7469905233ff38c0eb32f4d026777aefd568da9a80c85ea898e3e8,2026-02-10T08:03:43.735Z,2026-02-11T09:29:48.806Z,ACME\hbrown,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,6209fecb584b3b6528c63e84fc646e22fcae7266378ef4eca3b5e40a696e8935,2026-02-11T03:10:15.588Z,2026-02-15T13:55:52.986Z,ACME\hbrown,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,7c5adcd92162fa1f9a636949604eee9a9f1b76be1cb81b76fc5d88ed85e8c7d5,2026-02-17T16:49:16.504Z,2026-02-16T23:27:24.169Z,ACME\hbrown,Windows 10 Enterprise
|
||||
IT-WS-056,10.10.3.156,C:\Users\hbrown\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,433891d26a5a2f317d9b3ffc2b0152d710e3b0c4ce79dafdd85b9417bbb01962,2026-02-15T23:49:46.158Z,2026-02-18T13:41:28.915Z,ACME\hbrown,Windows 10 Enterprise
|
||||
HR-WS-057,10.10.1.157,C:\Users\svc_backup\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,159b1af58930df3d714818f7d1d26a8d0236aa9ae67072e4dc568efc6a239104,2026-02-11T05:36:19.999Z,2026-02-20T10:39:43.392Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
HR-WS-057,10.10.1.157,C:\Users\svc_backup\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,7c360af0f5933020a07c1d6eed650fd0f714c4e10e4814beec5bce187c7b0ac7,2026-02-19T13:20:38.501Z,2026-02-15T10:09:00.787Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
HR-WS-057,10.10.1.157,C:\Users\svc_backup\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,838982523731ed5c84539a743366f47f964d269c73bdd177df98706d8d90f174,2026-02-10T18:42:01.615Z,2026-02-15T03:31:22.686Z,ACME\svc_backup,Windows 11 Enterprise
|
||||
FIN-WS-058,10.10.2.158,C:\Users\svc_sql\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,fe7a2c2436e339959bc87cf30b907283b3469ebaf99d7cb4daa020f6a5fbdaa4,2026-02-16T06:35:42.030Z,2026-02-10T22:28:55.148Z,ACME\svc_sql,Windows Server 2022
|
||||
FIN-WS-058,10.10.2.158,C:\Users\svc_sql\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,d9b86651a70c83507d04c49b5fa690c6377c08ca36623cf5732c533b24048313,2026-02-14T16:20:05.890Z,2026-02-18T11:12:28.150Z,ACME\svc_sql,Windows Server 2022
|
||||
FIN-WS-058,10.10.2.158,C:\Users\svc_sql\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,104df32fcf74e7c765528724efe84ab9158695b0a5cd4a86ce05bd99385e91ba,2026-02-11T10:34:18.172Z,2026-02-10T12:10:06.417Z,ACME\svc_sql,Windows Server 2022
|
||||
FIN-WS-058,10.10.2.158,C:\Users\svc_sql\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,c796bdee0bb2b195dd9244dfebc01776627ec5f41f5cb687786d2bee6acacf6a,2026-02-16T09:53:53.186Z,2026-02-20T08:37:42.204Z,ACME\svc_sql,Windows Server 2022
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,6b89e7933f24098acaece345ae94dfde12d89fff310dd789f97ce69270d46eab,2026-02-18T01:35:39.439Z,2026-02-13T02:42:05.599Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,b62da658171c41525451fa9c18528e81c688c7f1997395a51bf39e93f57924e9,2026-02-19T16:05:28.770Z,2026-02-10T14:41:12.435Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,fb5b8f47dda60b1afda78c8c8ff07dec9380ea6e9b521bda6145d6ac6659d3ed,2026-02-14T06:47:04.073Z,2026-02-16T21:30:46.778Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,954380e542e548b7824fcb25fd3c18afb90c03c519a08339452170195a09c47c,2026-02-20T02:57:58.740Z,2026-02-16T03:04:39.739Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,5a4cb370b4ced46ebb17a5443b3db72cf056730a8a0c8aadf454c94f48b9d172,2026-02-14T19:10:46.875Z,2026-02-10T12:12:23.136Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,b8eaa121430f3c485fb8a684516fc7b3cd7b9c39ab2e526456fecd043a939543,2026-02-11T08:02:07.399Z,2026-02-14T06:47:25.094Z,ACME\svc_backup,Windows Server 2019
|
||||
SLS-WS-059,10.10.3.159,C:\Users\svc_backup\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,9a9c9bbc284bc127d351e3b9432bbbd44afbf872a6003e1a30a5aa79482284a7,2026-02-18T10:41:02.695Z,2026-02-16T20:30:42.029Z,ACME\svc_backup,Windows Server 2019
|
||||
ENG-WS-060,10.10.1.160,C:\Users\bwilson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,905845af52b2628c5f8726416dd272ee873dbe70e10ad2aa5e33f30eb9eaffec,2026-02-16T00:33:47.103Z,2026-02-18T09:46:51.688Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-060,10.10.1.160,C:\Users\bwilson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,68d38118d5daa87938602ba745b1bf2f7125419e7c7aaf0ae2cfbef4878b7f8d,2026-02-10T22:44:43.401Z,2026-02-17T17:55:07.034Z,ACME\bwilson,Windows 10 Enterprise
|
||||
ENG-WS-060,10.10.1.160,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,e4f8142754ff57407b8db15b9286f2f1450cbaf26b94e5caa798f297579b4899,2026-02-20T16:26:38.001Z,2026-02-14T15:29:18.592Z,ACME\bwilson,Windows 10 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,13ffc77c4d2b78c21e6d11207046fcc59271ae77fc1cd9859f26133f7d91f42d,2026-02-18T06:11:22.025Z,2026-02-18T16:02:03.866Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,29135c61c8b18b6370224fc250ed146ed968bfd5b367a2512c72c8cdb4f6f0ad,2026-02-13T09:07:54.810Z,2026-02-14T07:35:05.127Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,5a3dd12286335b7ff05bc1060aa2564b9108c99f88efe83c95582a9a30b35ec9,2026-02-19T21:59:53.396Z,2026-02-11T19:18:19.845Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,a5073ae78724059f1284d5f92dbc68db807d213a2471f16027963320d1f17f4e,2026-02-17T09:03:44.966Z,2026-02-20T17:50:40.944Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,6b90f7a64f916de8c91e98edcff21af430ee6afc954f5be53aed088c5581f910,2026-02-11T01:06:46.349Z,2026-02-15T22:35:57.810Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
LEG-WS-061,10.10.2.161,C:\Users\svc_sql\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,561f56f4c0c6994be45a4a9eab5a3d9c81d99553dd851e077b079d64e1b2c58e,2026-02-12T11:30:53.610Z,2026-02-11T00:37:33.548Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,a120ab7df76d7c44788eab5cbb1350b9d03206cf913fca72efe9f6afe51ad123,2026-02-11T09:37:08.530Z,2026-02-16T01:55:38.041Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,23d4e4171da879a726272c724ff0b813ac4715e66b2de06a06c35c9b0e3d3f74,2026-02-11T03:45:04.490Z,2026-02-12T22:34:50.380Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,78c62aa32adb30aa10c99a48a654a17d6ba2565052694fee609faa7ec48f63b0,2026-02-19T22:53:33.538Z,2026-02-18T04:43:04.236Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,cb15d61ce1c4fb56b82d8e1053d916011a5b9c33495392bcc7e0d4e783f37a08,2026-02-13T12:56:03.541Z,2026-02-16T22:39:08.082Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,d8b3929b63b82645d1e98619510bc375a0c67d79ac3851a53498bf1776857831,2026-02-16T20:56:38.831Z,2026-02-11T10:23:30.242Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,8486dcd804924cf07c9a95fb6b8f68e762267cd5516a642792a21ac08f1fb4d6,2026-02-15T21:01:29.305Z,2026-02-20T11:24:38.437Z,ACME\cjohnson,Windows Server 2022
|
||||
MKT-WS-062,10.10.3.162,C:\Users\cjohnson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,6fecf8734c6b547d074936e151d177c5ed93d08df36d872a032fa7c736adf135,2026-02-14T10:27:35.421Z,2026-02-18T00:02:57.434Z,ACME\cjohnson,Windows Server 2022
|
||||
EXEC-WS-063,10.10.1.163,C:\Users\jsmith\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,ebb5c7a8ecd668cc7ff2b1f9036ce5dbf823db9c50e1955111857cf71270f381,2026-02-11T15:45:16.625Z,2026-02-13T09:27:03.334Z,ACME\jsmith,Windows Server 2019
|
||||
EXEC-WS-063,10.10.1.163,C:\Users\jsmith\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,e55cdc89d11cf798a158574c213e1752eb017b02c4a6358a5c22bc7d492f0d9c,2026-02-13T16:05:32.443Z,2026-02-18T09:49:17.263Z,ACME\jsmith,Windows Server 2019
|
||||
EXEC-WS-063,10.10.1.163,C:\Users\jsmith\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,4588f93c0a4a3799e338b88071e9810f9f63e5ba45d32d468f06ce065fa83cad,2026-02-13T03:05:28.663Z,2026-02-17T17:31:52.069Z,ACME\jsmith,Windows Server 2019
|
||||
EXEC-WS-063,10.10.1.163,C:\Users\jsmith\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,5e2830be8d0af5ead2be0cc8cb478869d8b783df064e67577d2752ca55cd05b4,2026-02-12T06:55:43.373Z,2026-02-10T17:25:45.072Z,ACME\jsmith,Windows Server 2019
|
||||
EXEC-WS-063,10.10.1.163,C:\Users\jsmith\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,35e3cec5ecec093d2bbc50dfe4f7f7a8cfd46cc87cad68a2f7dc948440aab6b7,2026-02-10T09:13:59.971Z,2026-02-18T04:28:34.148Z,ACME\jsmith,Windows Server 2019
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,cd5493a1043b4ffb4df3685b46eed615d8662daa79f7a2d02725df040f396b99,2026-02-14T01:25:35.401Z,2026-02-10T15:43:08.147Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,e7319591e20ccfa6586ad0027c25f045334eb150c548c1f43f9854b137d65e2f,2026-02-13T06:53:42.529Z,2026-02-20T00:14:58.202Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,3ebe1653ca6b86b5d791c233e3d5623c1764fafed1b2a1c2a6ced99bb9d67c26,2026-02-18T06:49:49.434Z,2026-02-19T22:37:13.780Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,265343b80173d0c44090e573862e9ad56460cdc3ef0b39402fe0bab449d1e6aa,2026-02-15T14:09:22.053Z,2026-02-16T01:06:10.601Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,904ef6e441709467cf35c634dbca48d1c63f4e2663af34c8c620ea0d255545eb,2026-02-18T18:18:17.617Z,2026-02-14T10:27:13.566Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,c9eb1b9e7bcdf99e7807971a28ee14fc48a75fabb3b80d4cabc2c98c3ba023d2,2026-02-17T12:13:43.373Z,2026-02-12T13:15:59.541Z,ACME\admin,Windows 10 Enterprise
|
||||
IT-WS-064,10.10.2.164,C:\Users\admin\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,53948e33f1bce74320288297cd428cf43f7fe9ac2581289624c2fe1490fb1840,2026-02-18T09:38:15.985Z,2026-02-15T21:18:44.402Z,ACME\admin,Windows 10 Enterprise
|
||||
HR-WS-065,10.10.3.165,C:\Users\svc_sql\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,da6c7298b42163beca4bba0c240a8fa5d3f5578397fd2f51e34a9adcc5469269,2026-02-12T04:23:52.500Z,2026-02-16T23:58:39.393Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
HR-WS-065,10.10.3.165,C:\Users\svc_sql\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,3cae1022a0c930179b7f99bb003c03bda181df2694bfb42d6e589c99cbad73e6,2026-02-10T11:07:23.690Z,2026-02-12T06:31:34.874Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
HR-WS-065,10.10.3.165,C:\Users\svc_sql\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,7e81df3a05666b1ef5b0c95af3275fb209eec0b10a1e6f42fd50b32c9d2a579e,2026-02-16T15:04:42.252Z,2026-02-18T02:34:40.510Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
HR-WS-065,10.10.3.165,C:\Users\svc_sql\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,d6a665d33e9ef3954b6373434f0c80363cf4e458b90ed00991b789c3022c691d,2026-02-14T20:38:17.336Z,2026-02-12T00:57:22.446Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
HR-WS-065,10.10.3.165,C:\Users\svc_sql\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,7984444d1ea4788e1acd5c2a836f19f9b8fd288553a32ed3ab20078d4adae0ce,2026-02-16T02:09:06.353Z,2026-02-11T06:08:07.650Z,ACME\svc_sql,Windows 11 Enterprise
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,31cebee1c461110ebdd28cf66763a00fd56ab84d9596a973bd377a820e54bf2b,2026-02-12T03:27:13.153Z,2026-02-19T06:41:18.841Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,e4e158e8a008145a6be6fdf8c6ead22ae721d87b1776f30d5dd8a169870e363c,2026-02-12T06:51:19.449Z,2026-02-20T00:35:11.198Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,79cf9ce9c3e354d19518c5eda680299d8f023e9bd94f67af94d38feb99b8a038,2026-02-12T05:26:48.392Z,2026-02-15T04:55:42.352Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\salary_comparison.pdf,salary_comparison.pdf,320000,d2e0f1a3b4c5d6e7f8a9b0c1d2e3f4a5,0a4f748d49b234013155ae1ab8f5466a574341149e91cf37d977a5c471be4463,2026-02-14T09:05:34.293Z,2026-02-18T11:28:18.191Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,1e3af3cc86f94fc448501e00bcd272798fff0dce412d505d6235414b1f04c6f0,2026-02-12T19:26:34.776Z,2026-02-14T03:53:56.129Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,8e7001fe08fe15052a04585a55b2108920cee468c4296bb2ff5f4f2c516c3582,2026-02-17T10:38:52.019Z,2026-02-14T02:49:50.727Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,1814dcf2fa95a115bb8e0c5c957c9f84ab6f6749307168119b780e89f3f21186,2026-02-19T14:14:48.533Z,2026-02-17T13:12:41.994Z,ACME\cjohnson,Windows Server 2022
|
||||
FIN-WS-066,10.10.1.166,C:\Users\cjohnson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,f1d81fe35da8a7949fb9e7ea79199df7d74055daa4db4847318511a1eefd25de,2026-02-16T21:21:21.291Z,2026-02-15T12:50:50.170Z,ACME\cjohnson,Windows Server 2022
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,3c05306f88b0dff6f95c7dc3449987bc49bcdb9dfed9e97c2ec0395c66e5a5cd,2026-02-16T10:31:12.435Z,2026-02-17T23:04:17.736Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,4489e51c0cfb9187ab0fdbca080e0bd749a973f50efbf3cff96b993c0fdee23e,2026-02-12T23:14:11.601Z,2026-02-17T14:27:53.486Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,dde3491766c1b33932173b86534a46ee4c4711a7f088adeb4c068140343e909a,2026-02-13T23:55:59.509Z,2026-02-11T04:27:57.242Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,6a90bba572c051df728d448472035a1dd150003caa64038459e168ba59eebea9,2026-02-14T10:27:43.804Z,2026-02-20T01:24:42.718Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,e9fcf345bbd5ef8f80a6360555367c0504abbe1a43222081aeed9f56588bf269,2026-02-18T11:20:46.299Z,2026-02-17T14:55:17.274Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,21c98853d03c890e769fce2a7c794485ae2079670986f9618e3c62bfbc9ecacd,2026-02-10T21:42:37.190Z,2026-02-19T02:50:04.190Z,ACME\bwilson,Windows Server 2019
|
||||
SLS-WS-067,10.10.2.167,C:\Users\bwilson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,3f3c4d9db26b52f7ed6bc0e5a3f10a427b247e558ad65b9cce58a2ef9443f225,2026-02-18T22:05:31.921Z,2026-02-11T00:56:01.038Z,ACME\bwilson,Windows Server 2019
|
||||
ENG-WS-068,10.10.3.168,C:\Users\agarcia\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,ec01e92cadd0b99a66a2518cacad11cc0eef851342555af4cd28a72712d46066,2026-02-10T23:43:17.802Z,2026-02-19T14:30:29.217Z,ACME\agarcia,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,C:\Users\agarcia\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,771bc6f9562fbbd805d4d1199bffb7eb0e3b71a4f8fa8ff95f401cb56eaea40a,2026-02-16T22:18:55.736Z,2026-02-10T10:48:05.618Z,ACME\agarcia,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,C:\Users\agarcia\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,e3616b6ee97f9c422914e4437d9c7b9116535fb998704b11053cafbef8f5caf0,2026-02-15T10:08:21.739Z,2026-02-17T09:30:52.090Z,ACME\agarcia,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,C:\Users\agarcia\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,d46b4ded8da01716bf12c5c1c420af002fb4e12e4e504b1c27f2d0f97fcb05e9,2026-02-16T08:39:49.256Z,2026-02-17T12:39:27.283Z,ACME\agarcia,Windows 10 Enterprise
|
||||
ENG-WS-068,10.10.3.168,C:\Users\agarcia\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,f774be2460f78fe3038b0c36b049ff0c41796d3f98ced16f70ea921857aae059,2026-02-16T02:03:37.545Z,2026-02-19T00:01:17.162Z,ACME\agarcia,Windows 10 Enterprise
|
||||
LEG-WS-069,10.10.1.169,C:\Users\agarcia\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,2e9b2726c3dc07fab60f52a53164ea88be9ac9c51ca3cb2448bc674d33b57e5b,2026-02-19T16:21:41.161Z,2026-02-18T19:48:45.684Z,ACME\agarcia,Windows 11 Enterprise
|
||||
LEG-WS-069,10.10.1.169,C:\Users\agarcia\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,a6443d45766f4f45a04231e4efee599cde37fd581b2f20702092d0aa5dc4c008,2026-02-10T22:40:34.314Z,2026-02-19T23:32:14.355Z,ACME\agarcia,Windows 11 Enterprise
|
||||
LEG-WS-069,10.10.1.169,C:\Users\agarcia\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,8294d41139ac9064f4d340a4a07a4354bc5d543fa05b3c11689640b19af9039d,2026-02-13T14:07:02.261Z,2026-02-15T12:03:43.320Z,ACME\agarcia,Windows 11 Enterprise
|
||||
LEG-WS-069,10.10.1.169,C:\Users\agarcia\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,3943c17b7c3ea9f4271005397a3250e46dc9b9916b5e867872ea58ad67b73db0,2026-02-14T09:22:52.740Z,2026-02-18T08:09:32.149Z,ACME\agarcia,Windows 11 Enterprise
|
||||
MKT-WS-070,10.10.2.170,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,e7faa7c14424a33689ca8ef85e3703c971e21d3448ff4f623d490f98f1242c73,2026-02-12T01:52:38.277Z,2026-02-14T17:11:47.556Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-070,10.10.2.170,C:\Users\bwilson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,0b6da4421540a109a644d4d47ae254a716c786f46d2397d37df4467926a1bda7,2026-02-13T16:01:33.768Z,2026-02-14T06:37:16.953Z,ACME\bwilson,Windows Server 2022
|
||||
MKT-WS-070,10.10.2.170,C:\Users\bwilson\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,0636c7ed5a09944a4446220da010ea788c98cd9e4d6a9ddfc0b60e1fe52c72e2,2026-02-14T22:47:08.689Z,2026-02-12T16:57:54.421Z,ACME\bwilson,Windows Server 2022
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,23338d5308f157d1122030a212ace72df6c79c3ae165aeca93e16d63ec2f50de,2026-02-14T13:17:49.661Z,2026-02-10T12:24:57.779Z,ACME\gwhite,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,70f6351a55168625dd99c11e171fdec2674503cdcf99fea97d2debf59630fd85,2026-02-17T05:32:40.045Z,2026-02-19T09:17:43.290Z,ACME\gwhite,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,1c02887dcea5184a2a63641f595642bdb3b4c14f034fea4e0b2955c6aa1c6119,2026-02-17T04:22:22.064Z,2026-02-13T11:40:16.954Z,ACME\gwhite,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,f310c638facffd4bdc95b44c650efb600fba5ee3e54f216657a87cdfb0b80532,2026-02-20T17:15:22.759Z,2026-02-17T19:54:04.463Z,ACME\gwhite,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,2085fe98df0b6834d73b5207d21362268b536dd055a44e5e41618656f7455feb,2026-02-13T05:30:07.408Z,2026-02-16T17:31:27.254Z,ACME\gwhite,Windows Server 2019
|
||||
EXEC-WS-071,10.10.3.171,C:\Users\gwhite\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,fbd1d29f0548f3981cfbcd274ad5e4d825c7862900f62bafbbf718762aa2fb79,2026-02-18T12:59:22.361Z,2026-02-14T11:48:18.756Z,ACME\gwhite,Windows Server 2019
|
||||
IT-WS-072,10.10.1.172,C:\Users\svc_web\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,7692f56a4c44a44e773171dd3ec34024e7d573448f6aa42625f4d3bcd240c39f,2026-02-11T13:37:45.919Z,2026-02-15T12:15:23.430Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-072,10.10.1.172,C:\Users\svc_web\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,03befafc774c352818b391154cf66b6199af4f9eb9e7b5606c77cd36b71facd0,2026-02-20T03:07:57.263Z,2026-02-18T11:06:22.558Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-072,10.10.1.172,C:\Users\svc_web\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,73ac3d2a43c5d87fb74522b354f363875666172460d0e020ac71fa37a6867680,2026-02-13T06:07:58.308Z,2026-02-18T18:30:24.361Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-072,10.10.1.172,C:\Users\svc_web\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,f411eb96a17ea6cb558eba53e545c28f8d784fae2a12aec2b65caef0516c8176,2026-02-18T20:09:22.652Z,2026-02-12T14:24:22.345Z,ACME\svc_web,Windows 10 Enterprise
|
||||
IT-WS-072,10.10.1.172,C:\Users\svc_web\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,e114540379a736d14a5e1f0f82e5fb8e183e0945ae683512418f51e9a9b79346,2026-02-14T14:58:20.198Z,2026-02-12T11:00:24.118Z,ACME\svc_web,Windows 10 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\setup.exe,setup.exe,45000000,e7f5a6b8c9d0e1f2a3b4c5d6e7f8a9b0,3dc6f4e093be361fa151f14bc6077a34c1cea286c15d1a09b22123b6724d419c,2026-02-16T05:59:15.393Z,2026-02-12T00:55:01.385Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\free_movie_2026.torrent,free_movie_2026.torrent,45000,c1d9e0f2a3b4c5d6e7f8a9b0c1d2e3f4,3f0655a01a6b3429b7eb9f1918439cdbd987a0ba4e06479224f64b4e45b01d89,2026-02-14T12:28:20.557Z,2026-02-19T18:11:59.703Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,3fff89118c1a6e529daaebef99c05bd22ecbd04ddcfaa4285ab8184aa25a0494,2026-02-12T01:35:32.044Z,2026-02-18T16:31:31.245Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,f4e11e91d7318d5bc4aef4378611168bb912e9e17f18758da3e94e5d644bd365,2026-02-20T03:28:49.859Z,2026-02-10T10:07:26.992Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\project_plan.pptx,project_plan.pptx,1500000,d6e4f5a7b8c9d0e1f2a3b4c5d6e7f8a9,17faa693ce07c7fa04593fa3959248272361c37e0142e7fe6e91792d0585c177,2026-02-15T22:22:13.349Z,2026-02-15T20:00:23.982Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,fe90a7fc7f462d69d872741de59563f1dcef93a6c99b1b932b4f6b271aaeed2c,2026-02-14T04:11:17.266Z,2026-02-13T23:04:10.054Z,ACME\idavis,Windows 11 Enterprise
|
||||
HR-WS-073,10.10.2.173,C:\Users\idavis\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,94ed3d3bd229ac0657630683527033c8f9fb4a6cdf30a893481f77e4cfb51512,2026-02-13T15:36:48.654Z,2026-02-12T01:59:22.645Z,ACME\idavis,Windows 11 Enterprise
|
||||
FIN-WS-074,10.10.3.174,C:\Users\bwilson\Downloads\meeting_notes.docx,meeting_notes.docx,89000,b4c2d3e5f6a7b8c9d0e1f2a3b4c5d6e7,ce549ff35440924c40c190f8c1b16ead4dc2b558b0c218442535296f4474d785,2026-02-16T10:52:24.259Z,2026-02-10T11:23:13.028Z,ACME\bwilson,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,C:\Users\bwilson\Downloads\steam_installer.exe,steam_installer.exe,3500000,b0c8d9e1f2a3b4c5d6e7f8a9b0c1d2e3,0dbf41aa5ff9c756104db0403f9e88cb6fde5f2582bae1da88fe485f50c03ab6,2026-02-11T19:39:06.741Z,2026-02-14T14:19:50.933Z,ACME\bwilson,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,C:\Users\bwilson\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,b785bcda268397b9ce5430b7e6516a9f8690489734076972a1d91cf361628175,2026-02-11T14:03:50.795Z,2026-02-15T03:45:06.026Z,ACME\bwilson,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,C:\Users\bwilson\Downloads\crack_photoshop.exe,crack_photoshop.exe,12000000,f8a6b7c9d0e1f2a3b4c5d6e7f8a9b0c1,e460da57bc5e48b7ec2c5fbcb7f78427213b17d7c0351a77a8fe9f40e905c981,2026-02-11T00:15:54.201Z,2026-02-16T02:13:40.734Z,ACME\bwilson,Windows Server 2022
|
||||
FIN-WS-074,10.10.3.174,C:\Users\bwilson\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,1d95cfae3e70e193e0c6975efa9fb542f3bc346ef0673554a50ff887617fc597,2026-02-12T18:25:04.690Z,2026-02-18T00:31:07.288Z,ACME\bwilson,Windows Server 2022
|
||||
SLS-WS-075,10.10.1.175,C:\Users\agarcia\Downloads\vpn_config.ovpn,vpn_config.ovpn,1200,c5d3e4f6a7b8c9d0e1f2a3b4c5d6e7f8,bca414326a75be19e908b1315a25c8d20dad7a1623eddb487cbda08537f4a3e2,2026-02-17T08:59:26.488Z,2026-02-14T00:58:23.302Z,ACME\agarcia,Windows Server 2019
|
||||
SLS-WS-075,10.10.1.175,C:\Users\agarcia\Downloads\keygen_v2.exe,keygen_v2.exe,500000,a9b7c8d0e1f2a3b4c5d6e7f8a9b0c1d2,560a7076305f183923e79b0317362875b51580bcc35eefef03deff558cb20032,2026-02-16T15:14:05.569Z,2026-02-14T16:31:21.523Z,ACME\agarcia,Windows Server 2019
|
||||
SLS-WS-075,10.10.1.175,C:\Users\agarcia\Downloads\Q1_Budget_2026.xlsx,Q1_Budget_2026.xlsx,245000,a3f1b2c4d5e6f7a8b9c0d1e2f3a4b5c6,d052a9517af5231576a6bbe0509588d61146330e09b28e77707a35c777859515,2026-02-16T23:34:45.555Z,2026-02-17T23:17:09.444Z,ACME\agarcia,Windows Server 2019
|
||||
|
Reference in New Issue
Block a user