{"EventType":"IntrusionEvent", "EventSecond":1793199600, "EventMicrosecond":100000, "DeviceUUID":"11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID":1, "FirstPacketSecond":1793199600, "ConnectionID":73001, "InitiatorIP":"198.51.100.23", "ResponderIP":"10.10.20.15", "InitiatorPort":51359, "ResponderPort":80, "Protocol":"tcp", "IngressInterface":"outside", "EgressInterface":"inside", "IngressZone":"outside", "EgressZone":"inside", "PriorityID":1, "GeneratorID":1, "SignatureID":67359, "SignatureRevision":1, "Impact":5, "IntrusionRuleMessage":"SERVER-WEBAPP PHP serialized request activity", "Classification":"Attempted Administrator Privilege Gain", "WebApplication":"", "ClientApplication":"", "Application":"HTTP", "IntrusionPolicy":"default", "FirewallPolicy":"default", "FirewallRule":"Permit Outbound", "NAP_Policy":"Balanced Security and Connectivity", "InlineResult":"Would block", "InlineResultReason":"Intrusion Policy in \"Detection\" Inspection Mode", "IngressVRF":"Global", "EgressVRF":"Global", "HTTP_Hostname":"php-app.example.test", "HTTP_URI":"/upload.php", "SnortRuleGroups":"Rule Categories>Server>Other", "MitreAttackGroups":"", "ApplicationID":-, "ApplicationProductivityIndex":-, "ApplicationRiskIndex":-, "ClientApplicationID":-, "ClientApplicationProductivityIndex":4, "ClientApplicationRiskIndex":2, "Device":"172.16.0.10", "DeviceIP":"172.16.0.10", "DeviceSerialNumber":"9AD5V8FSS0D", "EgressInterfaceUUID":"efbb6160-f60a-11ef-a955-43d7eeccc024", "EgressZoneUUID":"efbcd7ac-f60a-11ef-a955-43d7eeccc024", "EventID":71, "FirewallPolicyUUID":"00000000-0000-0000-0000-000067c22fb5", "FirewallRuleID":268434433, "Hostname":"ip-172-16-0-50.us-east-2.compute.internal", "IngressInterfaceUUID":"ef9a2180-f60a-11ef-a955-43d7eeccc024", "IngressZoneUUID":"ef9c7c64-f60a-11ef-a955-43d7eeccc024", "InitiatorContinent":"North America", "InitiatorContinentCode":"na", "InitiatorCountry":"United States", "InitiatorCountryCode":"usa", "InitiatorCountryID":840, "InlineResultID":5, "InlineResultReasonID":2, "IntrusionPolicyRevUUID":"c1fab45a-f615-11ef-bd70-44d7eeccc024", "IntrusionPolicyUUID":"0210b9f5-95a7-0ed3-0000-004294971142", "NAP_PolicyUUID":"a6738542-f604-11ef-8765-a4eeeeccc024", "ProtocolID":6, "RealmID":0, "RealmName":"Invalid ID", "SensorID":2, "SnortVersionID":3, "UserID":9999997, "WebApplicationHTTP":"", "WebApplicationID":731, "WebApplicationProductivityIndex":2}
{"EventType":"IntrusionEvent", "EventSecond":1793199720, "EventMicrosecond":200000, "DeviceUUID":"11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID":1, "FirstPacketSecond":1793199720, "ConnectionID":73002, "InitiatorIP":"198.51.100.23", "ResponderIP":"10.10.20.15", "InitiatorPort":51360, "ResponderPort":80, "Protocol":"tcp", "IngressInterface":"outside", "EgressInterface":"inside", "IngressZone":"outside", "EgressZone":"inside", "PriorityID":1, "GeneratorID":1, "SignatureID":67360, "SignatureRevision":1, "Impact":5, "IntrusionRuleMessage":"SERVER-WEBAPP PHP upload request activity", "Classification":"Attempted Administrator Privilege Gain", "WebApplication":"", "ClientApplication":"", "Application":"HTTP", "IntrusionPolicy":"default", "FirewallPolicy":"default", "FirewallRule":"Permit Outbound", "NAP_Policy":"Balanced Security and Connectivity", "InlineResult":"Would block", "InlineResultReason":"Intrusion Policy in \"Detection\" Inspection Mode", "IngressVRF":"Global", "EgressVRF":"Global", "HTTP_Hostname":"php-app.example.test", "HTTP_URI":"/upload.php", "SnortRuleGroups":"Rule Categories>Server>Other", "MitreAttackGroups":"", "ApplicationID":-, "ApplicationProductivityIndex":-, "ApplicationRiskIndex":-, "ClientApplicationID":-, "ClientApplicationProductivityIndex":4, "ClientApplicationRiskIndex":2, "Device":"172.16.0.10", "DeviceIP":"172.16.0.10", "DeviceSerialNumber":"9AD5V8FSS0D", "EgressInterfaceUUID":"efbb6160-f60a-11ef-a955-43d7eeccc024", "EgressZoneUUID":"efbcd7ac-f60a-11ef-a955-43d7eeccc024", "EventID":71, "FirewallPolicyUUID":"00000000-0000-0000-0000-000067c22fb5", "FirewallRuleID":268434433, "Hostname":"ip-172-16-0-50.us-east-2.compute.internal", "IngressInterfaceUUID":"ef9a2180-f60a-11ef-a955-43d7eeccc024", "IngressZoneUUID":"ef9c7c64-f60a-11ef-a955-43d7eeccc024", "InitiatorContinent":"North America", "InitiatorContinentCode":"na", "InitiatorCountry":"United States", "InitiatorCountryCode":"usa", "InitiatorCountryID":840, "InlineResultID":5, "InlineResultReasonID":2, "IntrusionPolicyRevUUID":"c1fab45a-f615-11ef-bd70-44d7eeccc024", "IntrusionPolicyUUID":"0210b9f5-95a7-0ed3-0000-004294971142", "NAP_PolicyUUID":"a6738542-f604-11ef-8765-a4eeeeccc024", "ProtocolID":6, "RealmID":0, "RealmName":"Invalid ID", "SensorID":2, "SnortVersionID":3, "UserID":9999997, "WebApplicationHTTP":"", "WebApplicationID":731, "WebApplicationProductivityIndex":2}
{"EventType":"IntrusionEvent", "EventSecond":1793199765, "EventMicrosecond":300000, "DeviceUUID":"11bc8e94-f604-11ef-bcfe-eeb1de9c8a63", "InstanceID":1, "FirstPacketSecond":1793199765, "ConnectionID":73003, "InitiatorIP":"198.51.100.23", "ResponderIP":"10.10.20.15", "InitiatorPort":51375, "ResponderPort":80, "Protocol":"tcp", "IngressInterface":"outside", "EgressInterface":"inside", "IngressZone":"outside", "EgressZone":"inside", "PriorityID":1, "GeneratorID":1, "SignatureID":67375, "SignatureRevision":1, "Impact":5, "IntrusionRuleMessage":"SERVER-WEBAPP PHP session identifier disclosure activity", "Classification":"Attempted Administrator Privilege Gain", "WebApplication":"", "ClientApplication":"", "Application":"HTTP", "IntrusionPolicy":"default", "FirewallPolicy":"default", "FirewallRule":"Permit Outbound", "NAP_Policy":"Balanced Security and Connectivity", "InlineResult":"Would block", "InlineResultReason":"Intrusion Policy in \"Detection\" Inspection Mode", "IngressVRF":"Global", "EgressVRF":"Global", "HTTP_Hostname":"php-app.example.test", "HTTP_URI":"/upload.php", "SnortRuleGroups":"Rule Categories>Server>Other", "MitreAttackGroups":"", "ApplicationID":-, "ApplicationProductivityIndex":-, "ApplicationRiskIndex":-, "ClientApplicationID":-, "ClientApplicationProductivityIndex":4, "ClientApplicationRiskIndex":2, "Device":"172.16.0.10", "DeviceIP":"172.16.0.10", "DeviceSerialNumber":"9AD5V8FSS0D", "EgressInterfaceUUID":"efbb6160-f60a-11ef-a955-43d7eeccc024", "EgressZoneUUID":"efbcd7ac-f60a-11ef-a955-43d7eeccc024", "EventID":71, "FirewallPolicyUUID":"00000000-0000-0000-0000-000067c22fb5", "FirewallRuleID":268434433, "Hostname":"ip-172-16-0-50.us-east-2.compute.internal", "IngressInterfaceUUID":"ef9a2180-f60a-11ef-a955-43d7eeccc024", "IngressZoneUUID":"ef9c7c64-f60a-11ef-a955-43d7eeccc024", "InitiatorContinent":"North America", "InitiatorContinentCode":"na", "InitiatorCountry":"United States", "InitiatorCountryCode":"usa", "InitiatorCountryID":840, "InlineResultID":5, "InlineResultReasonID":2, "IntrusionPolicyRevUUID":"c1fab45a-f615-11ef-bd70-44d7eeccc024", "IntrusionPolicyUUID":"0210b9f5-95a7-0ed3-0000-004294971142", "NAP_PolicyUUID":"a6738542-f604-11ef-8765-a4eeeeccc024", "ProtocolID":6, "RealmID":0, "RealmName":"Invalid ID", "SensorID":2, "SnortVersionID":3, "UserID":9999997, "WebApplicationHTTP":"", "WebApplicationID":731, "WebApplicationProductivityIndex":2}