mirror of
https://github.com/activecm/rita
synced 2026-06-08 13:02:45 +00:00
Naomi Kramer
11 lines
8.2 KiB
Plaintext
11 lines
8.2 KiB
Plaintext
{"ts": 1517422336.04539, "uid": "C2nyFQkh6oijTV5hd", "id.orig_h": "10.55.100.111", "id.orig_p": 57488, "id.resp_h": "208.89.12.153", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "lptag.liveperson.net", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["Fboy4loJvroOw6ol", "F2dOiA4unEM6nUIaL4", "F2wxVc3kxAHfhJoZD4"], "subject": "CN=*.liveperson.net,OU=Enterprise SSL Pro Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=10007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "client_subject": "csubject", "client_issuer": "cissuer", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "b898351eb5e266aefd3723d466935494", "_path": "ssl"}
|
|
{"ts": 1517422336.047569, "uid": "CVK45n2YhAfzjO1osb", "id.orig_h": "10.55.100.111", "id.orig_p": 57489, "id.resp_h": "208.89.12.153", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "lptag.liveperson.net", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FwNiei8CnkiOxrGQ7", "FqstZD1byPg5uuGVBc", "F0o7WM29n2Bp0ZJlOd"], "subject": "CN=*.liveperson.net,OU=Enterprise SSL Pro Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=10007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "b898351eb5e266aefd3723d466935494", "_path": "ssl"}
|
|
{"ts": 1517422336.908272, "uid": "CbrqwH1I60ijqdvo5k", "id.orig_h": "10.55.100.111", "id.orig_p": 57491, "id.resp_h": "208.89.12.91", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "accdn.lpsnmedia.net", "resumed": false, "established": true, "cert_chain_fuids": ["F6ocsr1uKSaAJvRQj6", "FQEFEd206A6IEYrgja", "FdtYd61aSCbKiTOXx9"], "subject": "CN=*.lpsnmedia.net,OU=PlatinumSSL Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=100007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "389ed42c02ebecc32e73aa31def07e14", "_path": "ssl"}
|
|
{"ts": 1517422336.915725, "uid": "CCsyTNC6hgh4yvKNh", "id.orig_h": "10.55.100.111", "id.orig_p": 57492, "id.resp_h": "208.89.12.91", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "accdn.lpsnmedia.net", "resumed": false, "established": true, "cert_chain_fuids": ["FgSXhz2PR08zwU9zj5", "F0xhZZ33xEEWsiZfJ3", "Fy4sTv2zYbAhs9u6s"], "subject": "CN=*.lpsnmedia.net,OU=PlatinumSSL Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=100007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "389ed42c02ebecc32e73aa31def07e14", "_path": "ssl"}
|
|
{"ts": 1517422336.919708, "uid": "CUvK4P2FQEe55zklqd", "id.orig_h": "10.55.100.111", "id.orig_p": 57490, "id.resp_h": "208.89.12.91", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "accdn.lpsnmedia.net", "resumed": false, "established": true, "cert_chain_fuids": ["Flg3bk2zQhY71W1u5k", "FqlZdKkj3PbIrTT8", "FSVa17WAeqIXd3a99"], "subject": "CN=*.lpsnmedia.net,OU=PlatinumSSL Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=100007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "389ed42c02ebecc32e73aa31def07e14", "_path": "ssl"}
|
|
{"ts": 1517422337.44838, "uid": "CUkrdw1LYGK7JzksDi", "id.orig_h": "10.55.100.111", "id.orig_p": 57493, "id.resp_h": "208.89.12.87", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "va.v.liveperson.net", "resumed": false, "established": true, "cert_chain_fuids": ["FTQngf2u7zsllGnWVl", "FCfvtX1UJW7XGEXfkg", "Ffnn4v4C34aduNkr8g"], "subject": "CN=*.v.liveperson.net,OU=PlatinumSSL Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=100007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "389ed42c02ebecc32e73aa31def07e14", "_path": "ssl"}
|
|
{"ts": 1517422337.448738, "uid": "CktFHnR50Sdn2Ssg5", "id.orig_h": "10.55.100.111", "id.orig_p": 57494, "id.resp_h": "208.89.12.87", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "secp256r1", "server_name": "va.v.liveperson.net", "resumed": false, "established": true, "cert_chain_fuids": ["FSxHra1EFsAF2AfQJe", "Fl9arX1XZ5faPDh514", "FuCyps2A1zM0jIHwx7"], "subject": "CN=*.v.liveperson.net,OU=PlatinumSSL Wildcard,OU=Hosted by LivePerson\\\\, Inc.,OU=LivePerson\\\\, Inc.,O=LivePerson\\\\, Inc,street=New York,L=New York,ST=New York,postalCode=100007,C=US", "issuer": "CN=COMODO RSA Organization Validation Secure Server CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB", "validation_status": "ok", "ja3": "10ee8d30a5d01c042afd7b2b205facc4", "ja3s": "389ed42c02ebecc32e73aa31def07e14", "_path": "ssl"}
|
|
{"ts": 1517422355.307559, "uid": "ChzkTs6bcBCemLvPl", "id.orig_h": "10.55.100.104", "id.orig_p": 55041, "id.resp_h": "13.78.179.199", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "x25519", "server_name": "array808-prod.do.dsp.mp.microsoft.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FX4T0816swc5HHXx1b", "FNDSl21ELiyr5nb3f"], "subject": "CN=array801-prod.do.dsp.mp.microsoft.com", "issuer": "CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "ok", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "8415e777e0df6478fa9e17af0701002f", "_path": "ssl"}
|
|
{"ts": 1517422395.600808, "uid": "CgZojz1v4w0aM5GZ6c", "id.orig_h": "10.55.100.110", "id.orig_p": 65157, "id.resp_h": "13.78.187.58", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "curve": "x25519", "server_name": "array802-prod.do.dsp.mp.microsoft.com", "resumed": false, "next_protocol": "h2", "established": true, "cert_chain_fuids": ["FYusyH3iQzZnFSDMxg", "FSyUhkZERx31p9hnj"], "subject": "CN=array801-prod.do.dsp.mp.microsoft.com", "issuer": "CN=Microsoft IT TLS CA 4,OU=Microsoft IT,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "ok", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "8415e777e0df6478fa9e17af0701002f", "_path": "ssl"}
|
|
{"ts": 1517422417.952047, "uid": "CQIKKS1s2uSOJIENzl", "id.orig_h": "10.55.100.109", "id.orig_p": 62754, "id.resp_h": "64.4.54.253", "id.resp_p": 443, "version": "TLSv12", "cipher": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "curve": "secp256r1", "server_name": "settings-win.data.microsoft.com", "resumed": false, "established": true, "cert_chain_fuids": ["FiZtbG45k67AA254A5", "F7LPKs2mQtpnZgt5xf"], "subject": "CN=settings-win.data.microsoft.com,OU=WSE,O=Microsoft,L=Redmond,ST=WA,C=US", "issuer": "CN=Microsoft Secure Server CA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US", "validation_status": "unable to get local issuer certificate", "ja3": "bd0bf25947d4a37404f0424edf4db9ad", "ja3s": "d26ba888ffd53c3914cfbd00cf174690", "_path": "ssl"}
|