====================================================================================================
F2 验证结果  （since=2026-09-24T22:04:33  port=8088  明文 65536 字节  sha256=?）
====================================================================================================

--- /vg/req/br   [req]  对照：单层 br（请求方向 brotli 支持正常）
    http 事件      : 1
    明文特征告警    : [2013921, 2017173, 2027514, 2053456, 2017010, 2052797]
    anomaly         : 无
    fileinfo size   : [65536, 322]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/br-deflate   [req]  F2 变体（请求方向）
    http 事件      : 1
    明文特征告警    : 无
    其它告警        : [2221033]
    anomaly         : 无
    fileinfo size   : [8514, 267]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/br-gzip   [req]  F2 主（请求方向）
    http 事件      : 1
    明文特征告警    : 无
    其它告警        : [2221033]
    anomaly         : 无
    fileinfo size   : [8514, 343]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/gzip   [req]  对照：单层 gzip
    http 事件      : 1
    明文特征告警    : [2013921, 2017173, 2027514, 2053456, 2017010, 2052797]
    anomaly         : 无
    fileinfo size   : [65536, 280]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/gzip-gzip   [req]  对照：多层 gzip
    http 事件      : 1
    明文特征告警    : [2013921, 2017173, 2027514, 2053456, 2017010, 2052797]
    anomaly         : 无
    fileinfo size   : [65536, 357]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/plain   [req]  基线：无 CE
    http 事件      : 1
    明文特征告警    : [2013921, 2017173, 2027514, 2053456, 2017010, 2052797]
    anomaly         : 无
    fileinfo size   : [65536, 312]
    fileinfo sha256 : ['-...', '-...']
    判定            : 符合预期  告警=OK

--- /vg/req/zstd-gzip   [req]  
    http 事件      : 1
    明文特征告警    : [2013921, 2017173, 2027514, 2053456, 2017010, 2052797]
    其它告警        : [2221033]
    anomaly         : 无
    fileinfo size   : [8427, 339]
    fileinfo sha256 : ['-...', '-...']
    判定            : 不参与结论 —— 同 resp/zstd-gzip

--- /vg/resp/br   [resp]  对照：单层 br，快速路径（证明 brotli 支持正常）
    http 事件      : 1
    明文特征告警    : [2045883]
    anomaly         : 无
    fileinfo size   : [65536]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/br-deflate   [resp]  F2 变体：外层 deflate
    http 事件      : 1
    明文特征告警    : 无
    其它告警        : [2221033]
    anomaly         : ['ABNORMAL_CE_HEADER']
    fileinfo size   : [8514]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/br-gzip   [resp]  F2 主：br 在内 gzip 在外，慢路径丢 br 层
    http 事件      : 1
    明文特征告警    : 无
    其它告警        : [2221033]
    anomaly         : ['ABNORMAL_CE_HEADER']
    fileinfo size   : [8514]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/br-space   [resp]  对照：br 带尾随空格（实测被 trim，等同单层 br）
    http 事件      : 1
    明文特征告警    : [2045883]
    anomaly         : 无
    fileinfo size   : [65536]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/gzip   [resp]  对照：单层 gzip，快速路径
    http 事件      : 1
    明文特征告警    : [2045883]
    anomaly         : 无
    fileinfo size   : [65536]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/gzip-br   [resp]  F2 变体：br 在外
    http 事件      : 1
    明文特征告警    : 无
    其它告警        : [2221033]
    anomaly         : ['ABNORMAL_CE_HEADER']
    fileinfo size   : [8561]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/gzip-gzip   [resp]  对照：多层 gzip，证明慢路径多层机制本身可用
    http 事件      : 1
    明文特征告警    : [2045883]
    anomaly         : 无
    fileinfo size   : [65536]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/plain   [resp]  基线：无 CE
    http 事件      : 1
    明文特征告警    : [2045883]
    anomaly         : 无
    fileinfo size   : [65536]
    fileinfo sha256 : ['-...']
    判定            : 符合预期  告警=OK anomaly=OK fileinfo=明文=OK

--- /vg/resp/zstd-gzip   [resp]  
    http 事件      : 1
    明文特征告警    : [2045883]
    其它告警        : [2221033, 2002825]
    anomaly         : ['ABNORMAL_CE_HEADER']
    fileinfo size   : [8427]
    fileinfo sha256 : ['-...']
    判定            : 不参与结论 —— 判据失效：zstd 用 RAW_BLOCK 直接存明文，明文 canary 原样出现在 zstd 流里 —— 无论 Suricata 是否丢层，送检字节里都含明文，观察到的命中不说明任何问题

====================================================================================================
汇总（仅参与判定的变体）: 14/14 符合预期
  req/br       OK
  req/br-deflate OK
  req/br-gzip  OK
  req/gzip     OK
  req/gzip-gzip OK
  req/plain    OK
  resp/br      OK
  resp/br-deflate OK
  resp/br-gzip OK
  resp/br-space OK
  resp/gzip    OK
  resp/gzip-br OK
  resp/gzip-gzip OK
  resp/plain   OK

====================================================================================================
原始事件行
====================================================================================================
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013921,"rev":4,"signature":"ET WEB_SERVER DNS changer cPanel attempt","category":"Web Application Attack","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2011_11_18"],"signature_severity":["Minor"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017173,"rev":6,"signature":"ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body","category":"Attempted User Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2013_07_24"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2027514,"rev":3,"signature":"ET WEB_SERVER Observed FxCodeShell Web Shell Password","category":"A Network Trojan was detected","severity":1,"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Client_Endpoint"],"created_at":["2019_06_25"],"deployment":["Perimeter"],"malware_family":["FxCodeShell"],"performance_impact":["Low"],"signature_severity":["Major"],"updated_at":["2020_08_31"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2053456,"rev":1,"signature":"ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body","category":"Attempted Administrator Privilege Gain","severity":1,"source":{"ip":"115.200.248.4","port":33417},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Web_Server"],"confidence":["Medium"],"created_at":["2024_06_11"],"deployment":["SSLDecrypt","Perimeter"],"mitre_tactic_id":["TA0001"],"mitre_tactic_name":["Initial_Access"],"mitre_technique_id":["T1190"],"mitre_technique_name":["Exploit_Public_Facing_Application"],"performance_impact":["Moderate"],"signature_severity":["Major"],"tag":["SQL_Injection"],"updated_at":["2024_06_11"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017010,"rev":5,"signature":"ET WEB_SERVER Possible SQLi xp_cmdshell POST body","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2013_06_13"],"signature_severity":["Major"],"updated_at":["2020_09_18"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.852457+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2052797,"rev":1,"signature":"ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2024_05_21"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_05_21"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br","gaps":false,"state":"UNKNOWN","stored":false,"size":32768,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":7,"pkts_toclient":5,"bytes_toserver":7450,"bytes_toclient":338,"start":"2026-09-24T22:06:40.823389+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33417,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.880195+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/br","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:06:40.907208+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33417,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":322}}
{"timestamp":"2026-09-24T22:06:40.909058+0800","flow_id":158730247403282,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33417,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":322},"app_proto":"http","fileinfo":{"filename":"/vg/req/br","gaps":false,"state":"CLOSED","stored":false,"size":322,"tx_id":0}}
{"timestamp":"2026-09-24T22:06:40.966922+0800","flow_id":97007519501214,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33418,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-deflate","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br-deflate","gaps":false,"state":"UNKNOWN","stored":false,"size":1275,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:06:40.940090+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33418,"dest_port":8088}}
{"timestamp":"2026-09-24T22:06:40.996033+0800","flow_id":97007519501214,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33418,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/br-deflate","gaps":false,"state":"CLOSED","stored":false,"size":8514,"tx_id":0}}
{"timestamp":"2026-09-24T22:06:41.022292+0800","flow_id":97007519501214,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33418,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":267}}
{"timestamp":"2026-09-24T22:06:41.022403+0800","flow_id":97007519501214,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33418,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":267},"app_proto":"http","fileinfo":{"filename":"/vg/req/br-deflate","gaps":false,"state":"CLOSED","stored":false,"size":267,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:45.698455+0800","flow_id":1481417414736949,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33337,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/br-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":1273,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.672599+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33337,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.726055+0800","flow_id":1481417414736949,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33337,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/br-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8514,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:45.751318+0800","flow_id":1481417414736949,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33337,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":343}}
{"timestamp":"2026-09-24T22:04:45.751446+0800","flow_id":1481417414736949,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33337,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":343},"app_proto":"http","fileinfo":{"filename":"/vg/req/br-gzip","gaps":false,"state":"CLOSED","stored":false,"size":343,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:53.603730+0800","flow_id":1481417414736949,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33337,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":13,"pkts_toclient":11,"bytes_toserver":9561,"bytes_toclient":1219,"start":"2026-09-24T22:04:45.672599+0800","end":"2026-09-24T22:04:45.776320+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013921,"rev":4,"signature":"ET WEB_SERVER DNS changer cPanel attempt","category":"Web Application Attack","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2011_11_18"],"signature_severity":["Minor"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017173,"rev":6,"signature":"ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body","category":"Attempted User Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2013_07_24"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2027514,"rev":3,"signature":"ET WEB_SERVER Observed FxCodeShell Web Shell Password","category":"A Network Trojan was detected","severity":1,"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Client_Endpoint"],"created_at":["2019_06_25"],"deployment":["Perimeter"],"malware_family":["FxCodeShell"],"performance_impact":["Low"],"signature_severity":["Major"],"updated_at":["2020_08_31"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2053456,"rev":1,"signature":"ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body","category":"Attempted Administrator Privilege Gain","severity":1,"source":{"ip":"115.200.248.4","port":33335},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Web_Server"],"confidence":["Medium"],"created_at":["2024_06_11"],"deployment":["SSLDecrypt","Perimeter"],"mitre_tactic_id":["TA0001"],"mitre_tactic_name":["Initial_Access"],"mitre_technique_id":["T1190"],"mitre_technique_name":["Exploit_Public_Facing_Application"],"performance_impact":["Moderate"],"signature_severity":["Major"],"tag":["SQL_Injection"],"updated_at":["2024_06_11"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017010,"rev":5,"signature":"ET WEB_SERVER Possible SQLi xp_cmdshell POST body","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2013_06_13"],"signature_severity":["Major"],"updated_at":["2020_09_18"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.657303+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2052797,"rev":1,"signature":"ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2024_05_21"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_05_21"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58029,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:44.629229+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33335,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.688452+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/gzip","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:44.716182+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":280}}
{"timestamp":"2026-09-24T22:04:44.716317+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33335,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":280},"app_proto":"http","fileinfo":{"filename":"/vg/req/gzip","gaps":false,"state":"CLOSED","stored":false,"size":280,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:47.629282+0800","flow_id":1295147219645431,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33335,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":13,"pkts_toclient":11,"bytes_toserver":9868,"bytes_toclient":1156,"start":"2026-09-24T22:04:44.629229+0800","end":"2026-09-24T22:04:44.743939+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013921,"rev":4,"signature":"ET WEB_SERVER DNS changer cPanel attempt","category":"Web Application Attack","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2011_11_18"],"signature_severity":["Minor"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017173,"rev":6,"signature":"ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body","category":"Attempted User Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2013_07_24"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2027514,"rev":3,"signature":"ET WEB_SERVER Observed FxCodeShell Web Shell Password","category":"A Network Trojan was detected","severity":1,"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Client_Endpoint"],"created_at":["2019_06_25"],"deployment":["Perimeter"],"malware_family":["FxCodeShell"],"performance_impact":["Low"],"signature_severity":["Major"],"updated_at":["2020_08_31"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2053456,"rev":1,"signature":"ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body","category":"Attempted Administrator Privilege Gain","severity":1,"source":{"ip":"115.200.248.4","port":33336},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Web_Server"],"confidence":["Medium"],"created_at":["2024_06_11"],"deployment":["SSLDecrypt","Perimeter"],"mitre_tactic_id":["TA0001"],"mitre_tactic_name":["Initial_Access"],"mitre_technique_id":["T1190"],"mitre_technique_name":["Exploit_Public_Facing_Application"],"performance_impact":["Moderate"],"signature_severity":["Major"],"tag":["SQL_Injection"],"updated_at":["2024_06_11"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017010,"rev":5,"signature":"ET WEB_SERVER Possible SQLi xp_cmdshell POST body","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2013_06_13"],"signature_severity":["Major"],"updated_at":["2020_09_18"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.180240+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2052797,"rev":1,"signature":"ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2024_05_21"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_05_21"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":58240,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:45.155233+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33336,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:45.206354+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:45.230853+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":357}}
{"timestamp":"2026-09-24T22:04:45.230979+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33336,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":357},"app_proto":"http","fileinfo":{"filename":"/vg/req/gzip-gzip","gaps":false,"state":"CLOSED","stored":false,"size":357,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:54.599506+0800","flow_id":1511146041058340,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33336,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":13,"pkts_toclient":11,"bytes_toserver":9656,"bytes_toclient":1233,"start":"2026-09-24T22:04:45.155233+0800","end":"2026-09-24T22:04:45.254864+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013921,"rev":4,"signature":"ET WEB_SERVER DNS changer cPanel attempt","category":"Web Application Attack","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2011_11_18"],"signature_severity":["Minor"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017173,"rev":6,"signature":"ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body","category":"Attempted User Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2013_07_24"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_03_06"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2027514,"rev":3,"signature":"ET WEB_SERVER Observed FxCodeShell Web Shell Password","category":"A Network Trojan was detected","severity":1,"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Client_Endpoint"],"created_at":["2019_06_25"],"deployment":["Perimeter"],"malware_family":["FxCodeShell"],"performance_impact":["Low"],"signature_severity":["Major"],"updated_at":["2020_08_31"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2053456,"rev":1,"signature":"ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body","category":"Attempted Administrator Privilege Gain","severity":1,"source":{"ip":"115.200.248.4","port":33334},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Web_Server"],"confidence":["Medium"],"created_at":["2024_06_11"],"deployment":["SSLDecrypt","Perimeter"],"mitre_tactic_id":["TA0001"],"mitre_tactic_name":["Initial_Access"],"mitre_technique_id":["T1190"],"mitre_technique_name":["Exploit_Public_Facing_Application"],"performance_impact":["Moderate"],"signature_severity":["Major"],"tag":["SQL_Injection"],"updated_at":["2024_06_11"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017010,"rev":5,"signature":"ET WEB_SERVER Possible SQLi xp_cmdshell POST body","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2013_06_13"],"signature_severity":["Major"],"updated_at":["2020_09_18"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.113471+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2052797,"rev":1,"signature":"ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2024_05_21"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_05_21"]}},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/plain","gaps":false,"state":"UNKNOWN","stored":false,"size":32740,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":26,"pkts_toclient":22,"bytes_toserver":36064,"bytes_toclient":1460,"start":"2026-09-24T22:04:44.056831+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33334,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:44.163973+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/plain","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:44.188717+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":312}}
{"timestamp":"2026-09-24T22:04:44.191549+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33334,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":312},"app_proto":"http","fileinfo":{"filename":"/vg/req/plain","gaps":false,"state":"CLOSED","stored":false,"size":312,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:52.607866+0800","flow_id":1369990692857131,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33334,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":52,"pkts_toclient":44,"bytes_toserver":69136,"bytes_toclient":3462,"start":"2026-09-24T22:04:44.056831+0800","end":"2026-09-24T22:04:44.217464+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:46.217957+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_body","tc_progress":"response_started","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_method":"POST","protocol":"HTTP/1.1","length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"UNKNOWN","stored":false,"size":1236,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":3156,"bytes_toclient":140,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013921,"rev":4,"signature":"ET WEB_SERVER DNS changer cPanel attempt","category":"Web Application Attack","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2011_11_18"],"signature_severity":["Minor"],"updated_at":["2024_03_06"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017173,"rev":6,"signature":"ET EXPLOIT Apache Struts Possible OGNL Java ProcessBuilder in client body","category":"Attempted User Privilege Gain","severity":1,"metadata":{"confidence":["Medium"],"created_at":["2013_07_24"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_03_06"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2027514,"rev":3,"signature":"ET WEB_SERVER Observed FxCodeShell Web Shell Password","category":"A Network Trojan was detected","severity":1,"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Client_Endpoint"],"created_at":["2019_06_25"],"deployment":["Perimeter"],"malware_family":["FxCodeShell"],"performance_impact":["Low"],"signature_severity":["Major"],"updated_at":["2020_08_31"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2053456,"rev":1,"signature":"ET WEB_SERVER Possible SQL Injection sp_configure in HTTP Request Body","category":"Attempted Administrator Privilege Gain","severity":1,"source":{"ip":"115.200.248.4","port":33338},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Web_Server_Applications"],"attack_target":["Web_Server"],"confidence":["Medium"],"created_at":["2024_06_11"],"deployment":["SSLDecrypt","Perimeter"],"mitre_tactic_id":["TA0001"],"mitre_tactic_name":["Initial_Access"],"mitre_technique_id":["T1190"],"mitre_technique_name":["Exploit_Public_Facing_Application"],"performance_impact":["Moderate"],"signature_severity":["Major"],"tag":["SQL_Injection"],"updated_at":["2024_06_11"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2017010,"rev":5,"signature":"ET WEB_SERVER Possible SQLi xp_cmdshell POST body","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2013_06_13"],"signature_severity":["Major"],"updated_at":["2020_09_18"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2052797,"rev":1,"signature":"ET WEB_SERVER Possible bash shell piped to dev tcp Inbound to WebServer M3","category":"Potentially Bad Traffic","severity":2,"metadata":{"confidence":["Medium"],"created_at":["2024_05_21"],"signature_severity":["Major"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2024_05_21"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"files":[{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":10,"pkts_toclient":9,"bytes_toserver":9311,"bytes_toclient":744,"start":"2026-09-24T22:04:46.191882+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33338,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:46.248330+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"fileinfo","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","fileinfo":{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}}
{"timestamp":"2026-09-24T22:04:46.273824+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":339}}
{"timestamp":"2026-09-24T22:04:46.273949+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33338,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/req/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/json","http_method":"POST","protocol":"HTTP/1.1","status":200,"length":339},"app_proto":"http","fileinfo":{"filename":"/vg/req/zstd-gzip","gaps":false,"state":"CLOSED","stored":false,"size":339,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:51.612086+0800","flow_id":1950030550455824,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33338,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":13,"pkts_toclient":11,"bytes_toserver":9509,"bytes_toclient":1215,"start":"2026-09-24T22:04:46.191882+0800","end":"2026-09-24T22:04:46.299581+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:40.506460+0800","flow_id":152586171521714,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33326,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514}}
{"timestamp":"2026-09-24T22:04:40.506576+0800","flow_id":152586171521714,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33326,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33326},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_complete","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514},"files":[{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":11,"pkts_toclient":10,"bytes_toserver":828,"bytes_toclient":9430,"start":"2026-09-24T22:04:40.428742+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33326,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:40.506576+0800","flow_id":152586171521714,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33326,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:44.641959+0800","flow_id":152586171521714,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33326,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":894,"bytes_toclient":9430,"start":"2026-09-24T22:04:40.428742+0800","end":"2026-09-24T22:04:40.532714+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:42.552634+0800","flow_id":726427421271988,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33330,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":8,"bytes_toserver":374,"bytes_toclient":8001,"start":"2026-09-24T22:04:42.496814+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33330,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:42.552634+0800","flow_id":726427421271988,"in_iface":"eth0","event_type":"anomaly","src_ip":"115.200.248.4","src_port":33330,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"anomaly":{"app_proto":"http","type":"applayer","event":"ABNORMAL_CE_HEADER","layer":"proto_parser"}}
{"timestamp":"2026-09-24T22:04:42.580119+0800","flow_id":726427421271988,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33330,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8494}}
{"timestamp":"2026-09-24T22:04:42.580240+0800","flow_id":726427421271988,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33330,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-deflate","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8494},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":8514,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:47.629144+0800","flow_id":726427421271988,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33330,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":902,"bytes_toclient":9427,"start":"2026-09-24T22:04:42.496814+0800","end":"2026-09-24T22:04:42.607131+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:42.034551+0800","flow_id":549791124071767,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33329,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":9,"bytes_toserver":371,"bytes_toclient":8061,"start":"2026-09-24T22:04:41.979976+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33329,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:42.034551+0800","flow_id":549791124071767,"in_iface":"eth0","event_type":"anomaly","src_ip":"115.200.248.4","src_port":33329,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"anomaly":{"app_proto":"http","type":"applayer","event":"ABNORMAL_CE_HEADER","layer":"proto_parser"}}
{"timestamp":"2026-09-24T22:04:42.061288+0800","flow_id":549791124071767,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33329,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8506}}
{"timestamp":"2026-09-24T22:04:42.061402+0800","flow_id":549791124071767,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33329,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8506},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":8514,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:49.620553+0800","flow_id":549791124071767,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33329,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":11,"bytes_toserver":899,"bytes_toclient":9499,"start":"2026-09-24T22:04:41.979976+0800","end":"2026-09-24T22:04:42.087790+0800","age":1,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:41.027841+0800","flow_id":130730769821973,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33327,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-space","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514}}
{"timestamp":"2026-09-24T22:04:41.027949+0800","flow_id":130730769821973,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33327,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33327},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_complete","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-space","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514},"files":[{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":11,"pkts_toclient":10,"bytes_toserver":834,"bytes_toclient":9437,"start":"2026-09-24T22:04:40.947942+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33327,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:41.027949+0800","flow_id":130730769821973,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33327,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/br-space","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8514},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:50.616310+0800","flow_id":130730769821973,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33327,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":900,"bytes_toclient":9437,"start":"2026-09-24T22:04:40.947942+0800","end":"2026-09-24T22:04:41.053834+0800","age":1,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:39.965943+0800","flow_id":2225849078134144,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33325,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33325},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":2880},"files":[{"filename":"vg-test.bin","gaps":false,"state":"UNKNOWN","stored":false,"size":59638,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":6,"pkts_toclient":10,"bytes_toserver":500,"bytes_toclient":9740,"start":"2026-09-24T22:04:39.911461+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33325,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:39.991925+0800","flow_id":2225849078134144,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33325,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8820}}
{"timestamp":"2026-09-24T22:04:39.992046+0800","flow_id":2225849078134144,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33325,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8820},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:45.637695+0800","flow_id":2225849078134144,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33325,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":13,"pkts_toclient":11,"bytes_toserver":962,"bytes_toclient":9806,"start":"2026-09-24T22:04:39.911461+0800","end":"2026-09-24T22:04:40.017928+0800","age":1,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:43.072816+0800","flow_id":909868433829627,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33332,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":8,"bytes_toserver":371,"bytes_toclient":7995,"start":"2026-09-24T22:04:43.015237+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33332,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:43.072816+0800","flow_id":909868433829627,"in_iface":"eth0","event_type":"anomaly","src_ip":"115.200.248.4","src_port":33332,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"anomaly":{"app_proto":"http","type":"applayer","event":"ABNORMAL_CE_HEADER","layer":"proto_parser"}}
{"timestamp":"2026-09-24T22:04:43.100819+0800","flow_id":909868433829627,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33332,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8561}}
{"timestamp":"2026-09-24T22:04:43.100933+0800","flow_id":909868433829627,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33332,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-br","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8561},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":8561,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:47.629258+0800","flow_id":909868433829627,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33332,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":899,"bytes_toclient":9488,"start":"2026-09-24T22:04:43.015237+0800","end":"2026-09-24T22:04:43.128551+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:41.511339+0800","flow_id":298953426130981,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33328,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33328},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":5760},"files":[{"filename":"vg-test.bin","gaps":false,"state":"UNKNOWN","stored":false,"size":62729,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":8,"pkts_toclient":9,"bytes_toserver":637,"bytes_toclient":9462,"start":"2026-09-24T22:04:41.462821+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33328,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:41.534811+0800","flow_id":298953426130981,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33328,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8597}}
{"timestamp":"2026-09-24T22:04:41.534942+0800","flow_id":298953426130981,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33328,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/gzip-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8597},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:41.654663+0800","flow_id":298953426130981,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33328,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":901,"bytes_toclient":9528,"start":"2026-09-24T22:04:41.462821+0800","end":"2026-09-24T22:04:41.558303+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:39.474921+0800","flow_id":2148242513986495,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33324,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33324},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":50400},"files":[{"filename":"vg-test.bin","gaps":false,"state":"UNKNOWN","stored":false,"size":50400,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":33,"pkts_toclient":50,"bytes_toserver":2307,"bytes_toclient":70514,"start":"2026-09-24T22:04:39.369104+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33324,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:39.476130+0800","flow_id":2148242513986495,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33324,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":65536}}
{"timestamp":"2026-09-24T22:04:39.477717+0800","flow_id":2148242513986495,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33324,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/plain","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":65536},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":65536,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:43.646192+0800","flow_id":2148242513986495,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33324,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":44,"pkts_toclient":55,"bytes_toserver":3117,"bytes_toclient":73748,"start":"2026-09-24T22:04:39.369104+0800","end":"2026-09-24T22:04:39.503133+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
{"timestamp":"2026-09-24T22:04:43.594032+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33333,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2221033,"rev":1,"signature":"SURICATA HTTP Request abnormal Content-Encoding header","category":"Generic Protocol Command Decode","severity":3},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":8,"bytes_toserver":373,"bytes_toclient":7999,"start":"2026-09-24T22:04:43.541449+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33333,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:43.594032+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"alert","src_ip":"115.200.248.4","src_port":33333,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2002825,"rev":11,"signature":"ET INFO POSSIBLE Web Crawl using Curl","category":"Attempted Information Leak","severity":2,"metadata":{"confidence":["High"],"created_at":["2010_07_30"],"signature_severity":["Informational"],"tag":["Description_Generated_By_Proofpoint_Nexus"],"updated_at":["2020_10_19"]}},"ts_progress":"request_complete","tc_progress":"response_body","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":0},"app_proto":"http","direction":"to_server","flow":{"pkts_toserver":4,"pkts_toclient":8,"bytes_toserver":373,"bytes_toclient":7999,"start":"2026-09-24T22:04:43.541449+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33333,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:43.594032+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"anomaly","src_ip":"115.200.248.4","src_port":33333,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"anomaly":{"app_proto":"http","type":"applayer","event":"ABNORMAL_CE_HEADER","layer":"proto_parser"}}
{"timestamp":"2026-09-24T22:04:43.619779+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"http","src_ip":"115.200.248.4","src_port":33333,"dest_ip":"172.20.145.41","dest_port":8088,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8450}}
{"timestamp":"2026-09-24T22:04:43.619886+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"alert","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33333,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2045883,"rev":1,"signature":"ET WEB_SPECIFIC_APPS Wordpress - Successful Check for Malicious posts-layout (post-layout Doppelganger) Plugin - Infected Web Server","category":"access to a potentially vulnerable web application","severity":2,"source":{"ip":"115.200.248.4","port":33333},"target":{"ip":"172.20.145.41","port":8088},"metadata":{"affected_product":["Wordpress"],"attack_target":["Web_Server"],"confidence":["High"],"created_at":["2023_05_30"],"deployment":["SSLDecrypt","Perimeter"],"performance_impact":["Low"],"signature_severity":["Critical"],"updated_at":["2023_05_30"]}},"ts_progress":"request_complete","tc_progress":"response_complete","http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8450},"files":[{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}],"app_proto":"http","direction":"to_client","flow":{"pkts_toserver":11,"pkts_toclient":10,"bytes_toserver":835,"bytes_toclient":9381,"start":"2026-09-24T22:04:43.541449+0800","src_ip":"115.200.248.4","dest_ip":"172.20.145.41","src_port":33333,"dest_port":8088}}
{"timestamp":"2026-09-24T22:04:43.619886+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"fileinfo","src_ip":"172.20.145.41","src_port":8088,"dest_ip":"115.200.248.4","dest_port":33333,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","metadata":{"flowints":{"http.anomaly.count":1}},"http":{"hostname":"8.134.38.33","http_port":8088,"url":"/vg/resp/zstd-gzip","http_user_agent":"curl/8.22.0","http_content_type":"application/octet-stream","http_method":"GET","protocol":"HTTP/1.1","status":200,"length":8450},"app_proto":"http","fileinfo":{"filename":"vg-test.bin","gaps":false,"state":"CLOSED","stored":false,"size":8427,"tx_id":0}}
{"timestamp":"2026-09-24T22:05:44.642049+0800","flow_id":918133883936097,"in_iface":"eth0","event_type":"flow","src_ip":"115.200.248.4","src_port":33333,"dest_ip":"172.20.145.41","dest_port":8088,"ip_v":4,"proto":"TCP","app_proto":"http","flow":{"pkts_toserver":12,"pkts_toclient":10,"bytes_toserver":901,"bytes_toclient":9381,"start":"2026-09-24T22:04:43.541449+0800","end":"2026-09-24T22:04:43.645290+0800","age":0,"state":"closed","reason":"timeout","alerted":true,"tx_cnt":1},"metadata":{"flowints":{"http.anomaly.count":1}},"tcp":{"tcp_flags":"db","tcp_flags_ts":"db","tcp_flags_tc":"5b","syn":true,"fin":true,"psh":true,"ack":true,"ecn":true,"cwr":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}
