* Revamp unit tests * Increase coverage * Use go-acc to get cross packages coverage Signed-off-by: Shivam Sandbhor <shivam.sandbhor@gmail.com>
5362 lines
117 KiB
JSON
5362 lines
117 KiB
JSON
[
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.195 performed 'crowdsecurity/ssh-bf' (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.195",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.195"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "ruru"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 1.2.3.4 performed 'crowdsecurity/ssh-bf' (6 events over 41.41343ms) at 2020-10-26 12:54:48.786745305 +0100 CET m=+118.777986380",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"cn": "US",
|
|
"ip": "1.2.3.4",
|
|
"latitude": 47.913,
|
|
"longitude": -122.3042,
|
|
"scope": "Ip",
|
|
"value": "1.2.3.4"
|
|
},
|
|
"start_at": "2020-10-26T12:54:48.745331839+01:00",
|
|
"stop_at": "2020-10-26T12:54:48.786744746+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "rura"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "US"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "false"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "0"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 1.2.3.6 performed 'crowdsecurity/ssh-bf' (6 events over 33.162937ms) at 2020-10-26 12:55:33.554883657 +0100 CET m=+163.546124740",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"cn": "US",
|
|
"ip": "1.2.3.6",
|
|
"latitude": 47.913,
|
|
"longitude": -122.3042,
|
|
"scope": "Ip",
|
|
"value": "1.2.3.6"
|
|
},
|
|
"start_at": "2020-10-26T12:55:33.521720645+01:00",
|
|
"stop_at": "2020-10-26T12:55:33.554882819+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.194 performed 'crowdsecurity/ssh-bf' (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.194",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.194"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.193 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.193",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.193"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.192 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.192",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.192"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.191 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.191",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.191"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.190 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.190",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.190"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.189 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.189",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.189"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.188 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.188",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.188"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.187 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.187",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.187"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.186 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.186",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.186"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.185 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.185",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.185"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.184 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.184",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.184"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.183 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.183",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.183"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.182 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.182",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.182"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.181 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.181",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.181"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.180 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.180",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.180"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.179 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.179",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.179"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
},
|
|
{
|
|
"capacity": 5,
|
|
"decisions": null,
|
|
"events": [
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
},
|
|
{
|
|
"meta": [
|
|
{
|
|
"key": "log_type",
|
|
"value": "ssh_failed-auth"
|
|
},
|
|
{
|
|
"key": "source_ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
{
|
|
"key": "ASNNumber",
|
|
"value": "16276"
|
|
},
|
|
{
|
|
"key": "ASNOrg",
|
|
"value": "OVH SAS"
|
|
},
|
|
{
|
|
"key": "SourceRange",
|
|
"value": "91.121.72.0/21"
|
|
},
|
|
{
|
|
"key": "target_user",
|
|
"value": "root"
|
|
},
|
|
{
|
|
"key": "service",
|
|
"value": "ssh"
|
|
},
|
|
{
|
|
"key": "IsoCode",
|
|
"value": "FR"
|
|
},
|
|
{
|
|
"key": "IsInEU",
|
|
"value": "true"
|
|
}
|
|
],
|
|
"timestamp": "2020-10-02T17:09:08Z"
|
|
}
|
|
],
|
|
"events_count": 6,
|
|
"labels": null,
|
|
"leakspeed": "10s",
|
|
"message": "Ip 91.121.79.178 performed crowdsecurity/ssh-bf (6 events over 46.375699ms) at 2020-10-26 12:52:58.200237122 +0100 CET m=+8.191478202",
|
|
"remediation": true,
|
|
"scenario": "crowdsecurity/ssh-bf",
|
|
"scenario_hash": "4441dcff07020f6690d998b7101e642359ba405c2abb83565bbbdcee36de280f",
|
|
"scenario_version": "0.1",
|
|
"simulated": false,
|
|
"source": {
|
|
"as_name": "OVH SAS",
|
|
"cn": "FR",
|
|
"ip": "91.121.79.178",
|
|
"latitude": 50.646,
|
|
"longitude": 3.0758,
|
|
"range": "91.121.72.0/21",
|
|
"scope": "Ip",
|
|
"value": "91.121.79.178"
|
|
},
|
|
"start_at": "2020-10-26T12:52:58.153861334+01:00",
|
|
"stop_at": "2020-10-26T12:52:58.200236582+01:00"
|
|
}
|
|
] |