Mensajes de suceso de ejemplo de IBM Security Trusteer

Mensajes de muestra de IBM Security Trusteer cuando se utiliza el protocolo HTTP Receiver

Ejemplo 1:

El siguiente mensaje de suceso de ejemplo muestra que el mismo dispositivo ha realizado varios intentos de acceso sospechosos. También muestra que el suceso se ha generado a partir de la dirección IP de usuario 10.10.0.2.

{"feed_name":"account_takeover","version":"9","datetime":"2020-06-10 07:32:29","event_id":"e783d0dc7ae","last_user_ip":"10.0.0.2","last_user_ipv6":null,"app_name":"trusteerqa_business","detected_at":"http://host.domain2.test","activity":"policy58","translated_recommendation":null,"recommendation_reason_text":"Suspicious multiple accesses pattern from the same device","recommendation_reason_id":58,"risk_score":950,"resolution_id":"qnuwkfqcdajojinseudfxbhftlimptpu","policy_manager_recommendation":null,"policy_manager_reason":null,"policy_manager_reason_id":null,"policy_manager_risk_score":null,"persistent_device_id":"N/A","new_device_indication_zero_one":0,"country":null,"region":null,"city":null,"isp":null,"organization":null,"useragent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/72.0.3626.121 Safari/537.36","referrer":"","x_forwarded_for":"10.0.0.2","screen_resolution":null,"screen_dpi":24,"screen_touch":0,"client_time_zone":0,"rapport_machine_id":"","client_language":"en-US","platform":"Linux x86_64","cpu":"Linux x86_64","os":"Linux","accept_encoding":"gzip, deflate","mimes":0,"navigator_props":4231119849,"browser_version":"72.0.3626","client_charset":"UTF-8","browser":"Chrome","accept_charset":"","accept_language":"","network_data":"10.0.0.2","plugins":0,"malware_logical_name":"","infection_severity":"high","malware_signature":null,"formatted_is_targeted":"Maybe","encrypted_user_id":"","encryption_key_id":"trusteerqa.1.20110112-102448","app_id":"multi_login_tma","customer_session_id":"2s3as2jek91t98mb3mggkrt881","persistent_user_id":"aaaabbbbcccc0006"}

Ejemplo 2 (con IPv6):

El siguiente mensaje de suceso de ejemplo muestra que se ha detectado una actividad inusual de un dispositivo sospechoso que utiliza el navegador Tor. También muestra que el suceso se ha generado a partir de la dirección IP de usuario 10.10.0.2.

{"feed_name":"account_takeover","version":"9","datetime":"2018-08-07 12:11:31","event_id":"ecdc7245542","last_user_ip":null,"last_user_ipv6":"2001:DB8:AAAA:BBBB:CCCC:DDDD:EEEE:FFFF","app_name":"tma2","detected_at":"https://host.domain.test","activity":"login","translated_recommendation":"Alert","recommendation_reason_text":"Unusual activity from a suspicious device using the Tor browser","recommendation_reason_id":71,"risk_score":114,"resolution_id":"zguiblxuursugnjtulwawxhcmwixsfbs","policy_manager_recommendation":null,"policy_manager_reason":null,"policy_manager_reason_id":null,"policy_manager_risk_score":null,"persistent_device_id":"N/A","new_device_indication_zero_one":0,"country":"US","region":"99","city":null,"isp":"This is some ISP text","organization":"Test Organization","useragent":"Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","referrer":"/test/test/TAF","x_forwarded_for":"10.10.0.2","screen_resolution":null,"screen_dpi":8,"screen_touch":5,"client_time_zone":0,"rapport_machine_id":"-","client_language":"tr-TR","platform":"Linux x86_64","cpu":"Linux x86_64","os":"Windows 7","accept_encoding":"gzip, deflate, br","mimes":0,"navigator_props":4168486725,"browser_version":"11.0","client_charset":"UTF-8","browser":"IE","accept_charset":"","accept_language":"tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3","network_data":"10.10.0.2","plugins":3,"malware_logical_name":"","infection_severity":"high","malware_signature":null,"formatted_is_targeted":"Maybe","encrypted_user_id":"14D007Bc5cABF5dB23a24CB6CEF7a903f677a43Fbf27EaC34d0bE3242477337f8CF38A65c357b34480AFaBaaC8aBc60d6F8c3B05fdcbB1eDBaaF5fCd5eb8b704Eeac1F05a0a9067cEb9bc0AedA7aa9aF0016D1cA6C2AD3cEF6D22fb6B9E976ffbCcD60652Ca4Fc2EA0A8559AD4bc0c4FfE7c3537Bc3fdacaC9a322c4fC96d5cb05320E7FBAeac5E2a89aD5DAbcBF4575e205bc5a0DF35e06c2026C3df1D8728bAf1aD3120DC0","encryption_key_id":"","app_id":"tma2","customer_session_id":"ADf9FbFe9C01FDc5251FdFeEDCe16Cfa","persistent_user_id":"aaaabbbbcccc0002"}