Re: Large file detection
Michał Purzyński <[email protected]> Mon, 9 Dec 2019 13:44:02 -0800
| Newsgroups | gmane.comp.security.detection.bro |
|---|---|
| Message-ID | <[email protected]> |
--===============1343386831== Content-Type: multipart/alternative; boundary=Apple-Mail-4BDF8851-7A7D-4E2F-B88B-94860E482CF9 Content-Transfer-Encoding: 7bit --Apple-Mail-4BDF8851-7A7D-4E2F-B88B-94860E482CF9 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Just an idea without a code You could have a lookup table created from ssl events that keeps the list or= recent IP addresses associated with your vendor, recognized by x509 certifi= cate details and then a avoid alerting if there=E2=80=99s a March. > On Dec 9, 2019, at 1:25 PM, Scot Harris <[email protected]> wrote: >=20 > =EF=BB=BF > Running zeek 3.0. > =20 > Installed zeek/theflakes/bro-large_uploads (installed: master) - Raise not= ices on outgoing files over X bytes in size. > =20 > Getting a lot of events logged in notices log files. Fairly certain at th= is time that these events are due to Cylance application sending data to Cyl= ance cloud services for analysis. > =20 > Unable to get a specific list of aws ec2 servers as they are using a lot o= f them and they change regularly. > =20 > Any ideas on how to reduce these notices so the unusual events are more a= pparent? > =20 > Since it is looking at network packets I don=E2=80=99t think there is any w= ay to tie the file transfer back to the application. > =20 > Examples of the events found in the notices log files below. > =20 > =20 > =20 > =20 > =20 > _interface > ts > uid > id.orig_h > id.orig_p > id.resp_h > id.resp_p > fuid > file_mime_type > file_desc > proto > note > msg > sub > src > dst > p > n > peer_descr > actions > suppress_for > remote_location.country_code > remote_location.region > remote_location.city > remote_location.latitude > remote_location.longitude > af_packet::eno1 > 2019-12-09T00:00:59-0500 > COFjRo4ZBvf3xSXVK2 > 10.1.7.205 > 59028 > 3.231.142.14 > 443 > - > - > - > tcp > LargeUploads::Very_Large_Outgoing_Tx > Orig transmitted 29666232 bytes to resp. Duration 206837.349578 sec. Sourc= e is 07984coh.hollywood.local. Destination is ec2-3-231-142-14.compute-1.ama= zonaws.com. Connection UID COFjRo4ZBvf3xSXVK2. > Tx start: 12/06/2019 14:33:37 UTC, end: 12/09/2019 00:00:54 UTC > 10.1.7.205 > 3.231.142.14 > 443 > - > worker-1-1 > Notice::ACTION_LOG > 3600.000000 > - > - > - > - > - > af_packet::eno1 > 2019-12-09T00:01:00-0500 > CyrMsW3v1LqtqWVEu2 > 10.1.100.83 > 58699 > 3.224.236.241 > 443 > - > - > - > tcp > LargeUploads::Very_Large_Outgoing_Tx > Orig transmitted 17038390 bytes to resp. Duration 206903.826323 sec. Sourc= e is rfidsrv.hollywood.local. Destination is ec2-3-224-236-241.compute-1.ama= zonaws.com. Connection UID CyrMsW3v1LqtqWVEu2. > Tx start: 12/06/2019 14:32:31 UTC, end: 12/09/2019 00:00:54 UTC > 10.1.100.83 > 3.224.236.241 > 443 > - > worker-2-1 > Notice::ACTION_LOG > 3600.000000 > - > - > - > - > - > af_packet::eno1 > 2019-12-09T00:01:01-0500 > CarVkYRqSh34QSiOl > 10.1.23.90 > 57968 > 52.200.205.157 > 443 > - > - > - > tcp > LargeUploads::Very_Large_Outgoing_Tx > Orig transmitted 17852337 bytes to resp. Duration 206996.104661 sec. Sourc= e is . Destination is ec2-52-200-205-157.compute-1.amazonaws.com. Connection= UID CarVkYRqSh34QSiOl. > Tx start: 12/06/2019 14:31:00 UTC, end: 12/09/2019 00:00:56 UTC > 10.1.23.90 > 52.200.205.157 > 443 > - > worker-2-1 > Notice::ACTION_LOG > 3600.000000 > - > - > - > - > - > af_packet::eno1 > 2019-12-09T00:01:02-0500 > CooJjR1HWcj5B6Cwt7 > 10.1.41.74 > 58770 > 35.170.28.255 > 443 > - > - > - > tcp > LargeUploads::Very_Large_Outgoing_Tx > Orig transmitted 16385139 bytes to resp. Duration 205678.150834 sec. Sourc= e is 06208coh.hollywood.local. Destination is ec2-35-170-28-255.compute-1.am= azonaws.com. Connection UID CooJjR1HWcj5B6Cwt7. > Tx start: 12/06/2019 14:52:59 UTC, end: 12/09/2019 00:00:57 UTC > 10.1.41.74 > 35.170.28.255 > 443 > - > worker-1-2 > Notice::ACTION_LOG > 3600.000000 > - > - > - > - > - > =20 > =20 > Thank you. > =20 > __________________________________________ > Scot Harris > Network Engineer > City of Hollywood > Information Technology >=20 > P.O. Box 229045 > Hollywood, FL 33022-9045 > Office: 954-921-3304 > E-mail: [email protected] >=20 > Notice: Florida has a broad public records law. All correspondence sent to= the City of Hollywood via e-mail may be subject to disclosure as a matter o= f public record. > __________________________________________ > _______________________________________________ > Zeek mailing list > [email protected] > http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --Apple-Mail-4BDF8851-7A7D-4E2F-B88B-94860E482CF9 Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: quoted-printable <html><head><meta http-equiv=3D"content-type" content=3D"text/html; charset=3D= utf-8"></head><body dir=3D"auto"><div dir=3D"ltr">Just an idea without a cod= e</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">You could have a lookup t= able created from ssl events that keeps the list or recent IP addresses asso= ciated with your vendor, recognized by x509 certificate details and then a a= void alerting if there=E2=80=99s a March.</div><div dir=3D"ltr"><br></div><d= iv dir=3D"ltr"><br><blockquote type=3D"cite">On Dec 9, 2019, at 1:25 PM, Sco= t Harris <[email protected]> wrote:<br><br></blockquote></div><b= lockquote type=3D"cite"><div dir=3D"ltr">=EF=BB=BF <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii">= <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri",sans-serif;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} span.EmailStyle17 {mso-style-type:personal-compose; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-family:"Calibri",sans-serif;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> <div class=3D"WordSection1"> <p class=3D"MsoNormal">Running zeek 3.0.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Installed zeek/theflakes/bro-large_uploads (installed= : master) - Raise notices on outgoing files over X bytes in size.<o:p></o:p>= </p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Getting a lot of events logged in notices log files.&= nbsp; Fairly certain at this time that these events are due to Cylance appli= cation sending data to Cylance cloud services for analysis.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Unable to get a specific list of aws ec2 servers as t= hey are using a lot of them and they change regularly.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Any ideas on how to reduce these notices so the= unusual events are more apparent?<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Since it is looking at network packets I don=E2=80=99= t think there is any way to tie the file transfer back to the application.<o= :p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Examples of the events found in the notices log files= below.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <table class=3D"MsoNormalTable" border=3D"1" cellspacing=3D"0" cellpadding=3D= "0" style=3D"border-collapse:collapse"> <thead> <tr> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">_i= nterface<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">ts= <o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">ui= d<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">id= .orig_h<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">id= .orig_p<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">id= .resp_h<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">id= .resp_p<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">fu= id<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">fi= le_mime_type<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">fi= le_desc<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">pr= oto<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">no= te<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">ms= g<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">su= b<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">sr= c<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">ds= t<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">p<= o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">n<= o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">pe= er_descr<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">ac= tions<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">su= ppress_for<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">re= mote_location.country_code<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">re= mote_location.region<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">re= mote_location.city<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">re= mote_location.latitude<o:p></o:p></span></b></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal" align=3D"center" style=3D"text-align:center"><b><span= style=3D"font-size:12.0pt;font-family:"Times New Roman",serif">re= mote_location.longitude<o:p></o:p></span></b></p> </td> </tr> </thead> <tbody> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">2019-12-09T00:00:59-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">COFjRo4ZBvf3xSXVK2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.7.205<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">59028<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3.231.142.14<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p></s= pan></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Orig transmitted 29666232 bytes to resp. Duration 2= 06837.349578 sec. Source is 07984coh.hollywood.local. Destination is ec2-3-2= 31-142-14.compute-1.amazonaws.com. Connection UID COFjRo4ZBvf3xSXVK2.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Tx start: 12/06/2019 14:33:37 UTC, end: 12/09/2019= 00:00:54 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.7.205<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3.231.142.14<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">worker-1-1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">2019-12-09T00:01:00-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">CyrMsW3v1LqtqWVEu2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.100.83<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">58699<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3.224.236.241<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p></s= pan></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Orig transmitted 17038390 bytes to resp. Duration 2= 06903.826323 sec. Source is rfidsrv.hollywood.local. Destination is ec2-3-22= 4-236-241.compute-1.amazonaws.com. Connection UID CyrMsW3v1LqtqWVEu2.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Tx start: 12/06/2019 14:32:31 UTC, end: 12/09/2019= 00:00:54 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.100.83<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3.224.236.241<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">worker-2-1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">2019-12-09T00:01:01-0500<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">CarVkYRqSh34QSiOl<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.23.90<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">57968<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">52.200.205.157<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p></s= pan></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Orig transmitted 17852337 bytes to resp. Duration 2= 06996.104661 sec. Source is . Destination is ec2-52-200-205-157.compute= -1.amazonaws.com. Connection UID CarVkYRqSh34QSiOl.<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Tx start: 12/06/2019 14:31:00 UTC, end: 12/09/2019= 00:00:56 UTC<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.23.90<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">52.200.205.157<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">worker-2-1<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"background:#DDDDDD;padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> </tr> <tr> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">af_packet::eno1<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">2019-12-09T00:01:02-0500<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">CooJjR1HWcj5B6Cwt7<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.41.74<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">58770<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">35.170.28.255<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">tcp<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">LargeUploads::Very_Large_Outgoing_Tx<o:p></o:p></s= pan></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Orig transmitted 16385139 bytes to resp. Duration 2= 05678.150834 sec. Source is 06208coh.hollywood.local. Destination is ec2-35-= 170-28-255.compute-1.amazonaws.com. Connection UID CooJjR1HWcj5B6Cwt7.<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Tx start: 12/06/2019 14:52:59 UTC, end: 12/09/2019= 00:00:57 UTC<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">10.1.41.74<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">35.170.28.255<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">443<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">worker-1-2<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">Notice::ACTION_LOG<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">3600.000000<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> <td style=3D"padding:3.75pt 3.75pt 3.75pt 3.75pt"> <p class=3D"MsoNormal"><span style=3D"font-size:12.0pt;font-family:"Tim= es New Roman",serif">-<o:p></o:p></span></p> </td> </tr> </tbody> </table> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> <p class=3D"MsoNormal">Thank you.<o:p></o:p></p> <p class=3D"MsoNormal"><o:p> </o:p></p> </div> <div style=3D"font-size:9pt; font-family: ''Gill Sans MT'',sans-serif;">___= _______________________________________<br> <i><b>Scot Harris</b></i><br> Network Engineer<br> City of Hollywood<br> Information Technology<br> <br> P.O. Box 229045<br> Hollywood, FL 33022-9045<br> Office: 954-921-3304<br> E-mail: [email protected]<br> <div><img alt=3D"www.hollywoodfl.org" src=3D"http://apps.hollywoodfl.org/ima= ges/coh_logo_color.png" data-unique-identifier=3D""></div> Notice: Florida has a broad public records law. All correspondence sent to t= he City of Hollywood via e-mail may be subject to disclosure as a matter of p= ublic record.<br> __________________________________________</div> <span>_______________________________________________</span><br><span>Zeek m= ailing list</span><br><span>[email protected]</span><br><span>http://mailman.ICS= I.Berkeley.EDU/mailman/listinfo/zeek</span></div></blockquote></body></html>= --Apple-Mail-4BDF8851-7A7D-4E2F-B88B-94860E482CF9-- --===============1343386831== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Zeek mailing list [email protected] http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/zeek --===============1343386831==--