admin/activecm-rita
1
0
Fork 0
mirror of https://github.com/activecm/rita synced 2026-06-08 13:02:45 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
main
activecm-rita/test_data/json_with_all_fields/open_ssl.log
T
Naomi Kramer 906f53b3e5 BEAM ME UP SCOTTY 
Co-Authored-By: Liza Tsibur <liza@activecountermeasures.com>
2024-06-28 00:28:25 -04:00

21 lines
14 KiB
Plaintext
Raw Permalink Blame History

{"ts": 1517336108.231879, "uid": "CjlmYc3CNpKm4v8BTj", "id.orig_h": "10.55.100.100", "id.orig_p": 50255, "id.resp_h": "13.78.179.199", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "x25519", "server_name": "array808-prod.do.dsp.mp.microsoft.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["Fv7br62gosieiNvTsc", "FAJqFQ24i41JphPjN5"], "subject": "CN=array801-prod.do.dsp.mp.microsoft.com", "issuer": "CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "client_subject": "csubject", "client_issuer": "cissuer", "validation_status": "ok", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "8415e777e0df6478fa9e17af0701002f", "_path": "ssl"}
{"ts": 1517336108.614769, "uid": "CYEMQ72xi1LMLs8oql", "id.orig_h": "10.55.100.103", "id.orig_p": 51095, "id.resp_h": "13.78.184.186", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "x25519", "server_name": "array804-prod.do.dsp.mp.microsoft.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FuahL24bPTVHnd70g9", "F9ck1wcrCzDuoQhQ"], "subject": "CN=array801-prod.do.dsp.mp.microsoft.com", "issuer": "CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "ok", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "8415e777e0df6478fa9e17af0701002f", "_path": "ssl"}
{"ts": 1517336121.129435, "uid": "CsKSMm15OTrmYVM4r9", "id.orig_h": "10.55.100.111", "id.orig_p": 49557, "id.resp_h": "72.21.81.200", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "curve": "secp256r1", "server_name": "iecvlist.microsoft.com", "resumed": false, "established": true, "cert_chain_fuids": ["FZsLaxiraUcxvTtHb", "FITtDa2vYriufScmmf", "Fg5ki11A8efJb1vlQ7"], "subject": "CN=*.vo.msecnd.net", "issuer": "CN=Microsoft IT TLS CA 5,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "ok", "ja3": "0eecb7b1551fba4ec03851810d31743f", "ja3s": "46e8c907c5cc3cf4b4420e76da5b4dba", "_path": "ssl"}
{"ts": 1517336137.819118, "uid": "C7wxEI2w1VfODbHO31", "id.orig_h": "10.55.100.103", "id.orig_p": 51096, "id.resp_h": "13.78.186.254", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "x25519", "server_name": "array803-prod.do.dsp.mp.microsoft.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["F2MbX135ie4ps7V4D9", "FwJ91a2kT8SApQ6el7"], "subject": "CN=array801-prod.do.dsp.mp.microsoft.com", "issuer": "CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "ok", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "8415e777e0df6478fa9e17af0701002f", "_path": "ssl"}
{"ts": 1517336146.476143, "uid": "CeAyPy1uTaPr8TCjTl", "id.orig_h": "10.55.100.103", "id.orig_p": 51097, "id.resp_h": "64.4.54.254", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "curve": "secp256r1", "server_name": "v10.vortex-win.data.microsoft.com", "resumed": false, "established": true, "cert_chain_fuids": ["Ft8R9w2jK8065Nr8Yh", "F7vzXZ1tPbmCQQQrH8"], "subject": "CN=*.vortex-win.data.microsoft.com,OU=Microsoft,O=Microsoft Corporation,L=Redmond,ST=WA,C=US", "issuer": "CN=Microsoft Secure Server CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "unable to get local issuer certificate", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "d26ba888ffd53c3914cfbd00cf174690", "_path": "ssl"}
{"ts": 1517336154.222757, "uid": "CREW6U1jyERgWY3zSj", "id.orig_h": "10.55.100.109", "id.orig_p": 52069, "id.resp_h": "52.44.164.170", "id.resp_p": 443, "version": "TLSv10", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "curve": "secp256r1", "server_name": "www.alexa.com", "resumed": false, "established": true, "cert_chain_fuids": ["FSu1z230ps6hd68zG4", "FdriHh3sQxU3ldBpm5", "Fov8hz2km4TNZVqRQa", "FHuY0f2mulJAZfoZhl"], "subject": "CN=www.alexa.com", "issuer": "CN=Amazon,OU=Server CA 1B,O=Amazon,C=US", "validation_status": "ok", "ja3": "54328bd36c14bd82ddaa0c04b25ed9ad", "ja3s": "39f74f5618836d3c5f7dcccc9f67ba75", "_path": "ssl"}
{"ts": 1517336155.940017, "uid": "CmHW8n4JvMKFtSNDce", "id.orig_h": "10.55.100.109", "id.orig_p": 52070, "id.resp_h": "98.138.252.39", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "www.yahoo.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["F8Cifn42eKrzKYSKyl", "FrxB4a2UBD7p3pjK9k"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336155.938573, "uid": "Cxy1cE8YcFdRF4FA8", "id.orig_h": "10.55.100.109", "id.orig_p": 52071, "id.resp_h": "98.138.252.39", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "www.yahoo.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FllGC4GbK8qQLlWpb", "FAUNf02vs5JOqDNXO1"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.481779, "uid": "CVRSOV1odNSLB3grgj", "id.orig_h": "10.55.100.109", "id.orig_p": 52076, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FIhO1tPcQxk6jdl2", "FVAamAhw3Uj7aV3Q"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.482954, "uid": "CmgX6M2RAetJ4KrVJg", "id.orig_h": "10.55.100.109", "id.orig_p": 52072, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FZoPuE1ijBjnCIj6ed", "FP1FaW2Y91gnxIWw3"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.490124, "uid": "CkmtUbYs0OsBM9rIb", "id.orig_h": "10.55.100.109", "id.orig_p": 52073, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FsRfRr15vK8vvjDDag", "FXWBI7ueXoE1p7e0a"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.490426, "uid": "C9YbC33DIITRfjcKE2", "id.orig_h": "10.55.100.109", "id.orig_p": 52075, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FWAOzr44xk9iM2fUFe", "Fe5oRY3zXBn6dNA9C3"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.504648, "uid": "C3uGCg2PZiXv0EXmXe", "id.orig_h": "10.55.100.109", "id.orig_p": 52077, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FfCuV91GSjNaAzwEY2", "FZ7cqC1yW3TlhtN6G6"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.493314, "uid": "C2Xfq11LQij1b1EI73", "id.orig_h": "10.55.100.109", "id.orig_p": 52074, "id.resp_h": "98.139.180.180", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "mbp.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FSMINiJHY0AnkvQ38", "F6VFVz4f62CjYMgVe3"], "subject": "CN=*.www.yahoo.com,O=Yahoo! Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.714003, "uid": "Ct7qKm2MRtt6gZKJx9", "id.orig_h": "10.55.100.109", "id.orig_p": 52079, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FGAuv12vLKdXHa0hfk", "FnxxQbsJBzfUD0344"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.709488, "uid": "C6indR1SYa3x5uGt0e", "id.orig_h": "10.55.100.109", "id.orig_p": 52078, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["Fx5k2fJu907wH0jx4", "Fl0e0z1fXWmukELlwi"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.720665, "uid": "C8Wswu2EQOXCJBDfrk", "id.orig_h": "10.55.100.109", "id.orig_p": 52083, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FyvFko4rg3jzAx76Pb", "FPZ3Aw44ddsS53TXE"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.722675, "uid": "C7267t8RFt8bkJkG8", "id.orig_h": "10.55.100.109", "id.orig_p": 52081, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["F9kJ5e2dQzNUtQe871", "FQThMkwtgXg7QUHB5"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.72397, "uid": "C6B2hc3zcPFNpkYc96", "id.orig_h": "10.55.100.109", "id.orig_p": 52082, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FYUuugH5LeYpjM3l5", "FzZgrU1sLjzwEDQ14c"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
{"ts": 1517336156.720547, "uid": "CRl9g9k3QHZKZUaI9", "id.orig_h": "10.55.100.109", "id.orig_p": 52080, "id.resp_h": "69.147.92.12", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "s.yimg.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FWT4rl3FsYj6fLi5j8", "FL4NtY3yOhEzUqJP16"], "subject": "CN=*.yahoo.com,O=Yahoo Holdings\\\\, Inc.,L=Sunnyvale,ST=CA,C=US", "issuer": "CN=DigiCert SHA2 High Assurance Server CA,OU=www.digicert.com,O=DigiCert Inc,C=US", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "76cc3e2d3028143b23ec18e27dbd7ca9", "_path": "ssl"}
Reference in New Issue View Git Blame Copy Permalink