Large file detection
Scot Harris <[email protected]> Mon, 9 Dec 2019 21:20:20 +0000
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <DM5PR09MB22825714907724F952CF7E32A9580@DM5PR09MB2282.namprd09.prod.outlook.com> |
--===============0914313329== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_DM5PR09MB22825714907724F952CF7E32A9580DM5PR09MB2282namp_" --_000_DM5PR09MB22825714907724F952CF7E32A9580DM5PR09MB2282namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Running zeek 3.0. Installed zeek/theflakes/bro-large_uploads (installed: master) - Raise noti= ces on outgoing files over X bytes in size. Getting a lot of events logged in notices log files. Fairly certain at thi= s time that these events are due to Cylance application sending data to Cyl= ance cloud services for analysis. Unable to get a specific list of aws ec2 servers as they are using a lot of= them and they change regularly. Any ideas on how to reduce these notices so the unusual events are more ap= parent? Since it is looking at network packets I don't think there is any way to ti= e the file transfer back to the application. Examples of the events found in the notices log files below. _interface ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude af_packet::eno1 2019-12-09T00:00:59-0500 COFjRo4ZBvf3xSXVK2 10.1.7.205 59028 3.231.142.14 443 - - - tcp LargeUploads::Very_Large_Outgoing_Tx Orig transmitted 29666232 bytes to resp. Duration 206837.349578 sec. Source= is 07984coh.hollywood.local. Destination is ec2-3-231-142-14.compute-1.ama= zonaws.com. Connection UID COFjRo4ZBvf3xSXVK2. Tx start: 12/06/2019 14:33:37 UTC, end: 12/09/2019 00:00:54 UTC 10.1.7.205 3.231.142.14 443 - worker-1-1 Notice::ACTION_LOG 3600.000000 - - - - - af_packet::eno1 2019-12-09T00:01:00-0500 CyrMsW3v1LqtqWVEu2 10.1.100.83 58699 3.224.236.241 443 - - - tcp LargeUploads::Very_Large_Outgoing_Tx Orig transmitted 17038390 bytes to resp. Duration 206903.826323 sec. Source= is rfidsrv.hollywood.local. Destination is ec2-3-224-236-241.compute-1.ama= zonaws.com. Connection UID CyrMsW3v1LqtqWVEu2. Tx start: 12/06/2019 14:32:31 UTC, end: 12/09/2019 00:00:54 UTC 10.1.100.83 3.224.236.241 443 - worker-2-1 Notice::ACTION_LOG 3600.000000 - - - - - af_packet::eno1 2019-12-09T00:01:01-0500 CarVkYRqSh34QSiOl 10.1.23.90 57968 52.200.205.157 443 - - - tcp LargeUploads::Very_Large_Outgoing_Tx Orig transmitted 17852337 bytes to resp. Duration 206996.104661 sec. Source= is . Destination is ec2-52-200-205-157.compute-1.amazonaws.com. Connection= UID CarVkYRqSh34QSiOl. Tx start: 12/06/2019 14:31:00 UTC, end: 12/09/2019 00:00:56 UTC 10.1.23.90 52.200.205.157 443 - worker-2-1 Notice::ACTION_LOG 3600.000000 - - - - - af_packet::eno1 2019-12-09T00:01:02-0500 CooJjR1HWcj5B6Cwt7 10.1.41.74 58770 35.170.28.255 443 - - - tcp LargeUploads::Very_Large_Outgoing_Tx Orig transmitted 16385139 bytes to resp. Duration 205678.150834 sec. Source= is 06208coh.hollywood.local. Destination is ec2-35-170-28-255.compute-1.am= azonaws.com. Connection UID CooJjR1HWcj5B6Cwt7. Tx start: 12/06/2019 14:52:59 UTC, end: 12/09/2019 00:00:57 UTC 10.1.41.74 35.170.28.255 443 - worker-1-2 Notice::ACTION_LOG 3600.000000 - - - - - Thank you. __________________________________________ Scot Harris Network Engineer City of Hollywood Information Technology P.O. Box 229045 Hollywood, FL 33022-9045 Office: 954-921-3304 E-mail: [email protected] [www.hollywoodfl.org] Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record. __________________________________________ --_000_DM5PR09MB22825714907724F952CF7E32A9580DM5PR09MB2282namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Running zeek 3.0.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Installed zeek/theflakes/bro-large_uploads (installe= d: master) - Raise notices on outgoing files over X bytes in size.<o:p></o:= p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Getting a lot of events logged in notices log files.= Fairly certain at this time that these events are due to Cylance app= lication sending data to Cylance cloud services for analysis.<o:p></o:p></p= > <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Unable to get a specific list of aws ec2 servers as = they are using a lot of them and they change regularly.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Any ideas on how to reduce these notices so th= e unusual events are more apparent?<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Since it is looking at network packets I don’t= think there is any way to tie the file transfer back to the application.<o= :p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Examples of the events found in the notices log file= s below.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <table class=3D"MsoNormalTable" border=3D"1" cellspacing=3D"0" cellpadding= =3D"0" style=3D"border-collapse:collapse"> <thead> <tr> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= _interface<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= ts<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= uid<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= id.orig_h<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= id.orig_p<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= id.resp_h<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= id.resp_p<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= fuid<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= file_mime_type<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= file_desc<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= proto<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= note<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= msg<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= sub<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= src<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= dst<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= p<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= n<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= peer_descr<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= actions<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= suppress_for<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= remote_location.country_code<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= remote_location.region<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= remote_location.city<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= remote_location.latitude<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><spa= n style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">= remote_location.longitude<o:p></o:p></span></b></p> </td> </tr> </thead> <tbody> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">2019-12-09T00:00:59-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">COFjRo4ZBvf3xSXVK2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.7.205<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">59028<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3.231.142.14<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p><= /span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Orig transmitted 29666232 bytes to resp. Duratio= n 206837.349578 sec. Source is 07984coh.hollywood.local. Destination is ec2= -3-231-142-14.compute-1.amazonaws.com. Connection UID COFjRo4ZBvf3xSXVK2.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Tx start: 12/06/2019 14:33:37 UTC, end: 12/09/20= 19 00:00:54 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.7.205<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3.231.142.14<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">worker-1-1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">2019-12-09T00:01:00-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">CyrMsW3v1LqtqWVEu2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.100.83<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">58699<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3.224.236.241<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p><= /span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Orig transmitted 17038390 bytes to resp. Duratio= n 206903.826323 sec. Source is rfidsrv.hollywood.local. Destination is ec2-= 3-224-236-241.compute-1.amazonaws.com. Connection UID CyrMsW3v1LqtqWVEu2.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Tx start: 12/06/2019 14:32:31 UTC, end: 12/09/20= 19 00:00:54 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.100.83<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3.224.236.241<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">worker-2-1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">2019-12-09T00:01:01-0500<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">CarVkYRqSh34QSiOl<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.23.90<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">57968<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">52.200.205.157<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p><= /span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Orig transmitted 17852337 bytes to resp. Duratio= n 206996.104661 sec. Source is . Destination is ec2-52-200-205-157.com= pute-1.amazonaws.com. Connection UID CarVkYRqSh34QSiOl.<o:p></o:p></span></= p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Tx start: 12/06/2019 14:31:00 UTC, end: 12/09/20= 19 00:00:56 UTC<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.23.90<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">52.200.205.157<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">worker-2-1<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">2019-12-09T00:01:02-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">CooJjR1HWcj5B6Cwt7<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.41.74<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">58770<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">35.170.28.255<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p><= /span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Orig transmitted 16385139 bytes to resp. Duratio= n 205678.150834 sec. Source is 06208coh.hollywood.local. Destination is ec2= -35-170-28-255.compute-1.amazonaws.com. Connection UID CooJjR1HWcj5B6Cwt7.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Tx start: 12/06/2019 14:52:59 UTC, end: 12/09/20= 19 00:00:57 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">10.1.41.74<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">35.170.28.255<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">worker-1-2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Ti= mes New Roman",serif">-<o:p></o:p></span></p> </td> </tr> </tbody> </table> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Thank you.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div style=3D"font-size:9pt; font-family: ''Gill Sans MT'',sans-serif;">__= ________________________________________<br> <i><b>Scot Harris</i></b><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: [email protected]<br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/im= ages/coh_logo_color.png"></div> Notice: Florida has a broad public records law. All correspondence sent to = the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record.<br> __________________________________________</div> </body> </html> --_000_DM5PR09MB22825714907724F952CF7E32A9580DM5PR09MB2282namp_-- --===============0914313329== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============0914313329==--