IBM Security Trusteer サンプル・イベント・メッセージ

HTTPを使用する際の IBM のサンプルメッセージ

サンプル 1:

以下のサンプル・イベント・メッセージは、同じデバイスが複数の疑わしいアクセス試行を行ったことを示しています。 また、イベントがユーザー IP アドレス 10.10.0.2 から生成されたことも示しています。

{"feed_name":"account_takeover","version":"9","datetime":"2020-06-10 07:32:29","event_id":"e783d0dc7ae","last_user_ip":"10.0.0.2","last_user_ipv6":null,"app_name":"trusteerqa_business","detected_at":"http://host.domain2.test","activity":"policy58","translated_recommendation":null,"recommendation_reason_text":"Suspicious multiple accesses pattern from the same device","recommendation_reason_id":58,"risk_score":950,"resolution_id":"qnuwkfqcdajojinseudfxbhftlimptpu","policy_manager_recommendation":null,"policy_manager_reason":null,"policy_manager_reason_id":null,"policy_manager_risk_score":null,"persistent_device_id":"N/A","new_device_indication_zero_one":0,"country":null,"region":null,"city":null,"isp":null,"organization":null,"useragent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/72.0.3626.121 Safari/537.36","referrer":"","x_forwarded_for":"10.0.0.2","screen_resolution":null,"screen_dpi":24,"screen_touch":0,"client_time_zone":0,"rapport_machine_id":"","client_language":"en-US","platform":"Linux x86_64","cpu":"Linux x86_64","os":"Linux","accept_encoding":"gzip, deflate","mimes":0,"navigator_props":4231119849,"browser_version":"72.0.3626","client_charset":"UTF-8","browser":"Chrome","accept_charset":"","accept_language":"","network_data":"10.0.0.2","plugins":0,"malware_logical_name":"","infection_severity":"high","malware_signature":null,"formatted_is_targeted":"Maybe","encrypted_user_id":"","encryption_key_id":"trusteerqa.1.20110112-102448","app_id":"multi_login_tma","customer_session_id":"2s3as2jek91t98mb3mggkrt881","persistent_user_id":"aaaabbbbcccc0006"}

サンプル 2 (IPv6 を使用):

以下のサンプル・イベント・メッセージは、Tor ブラウザーを使用する疑わしいデバイスからの異常なアクティビティーが検出されたことを示しています。 また、イベントがユーザー IP アドレス 10.10.0.2 から生成されたことも示しています。

{"feed_name":"account_takeover","version":"9","datetime":"2018-08-07 12:11:31","event_id":"ecdc7245542","last_user_ip":null,"last_user_ipv6":"2001:DB8:AAAA:BBBB:CCCC:DDDD:EEEE:FFFF","app_name":"tma2","detected_at":"https://host.domain.test","activity":"login","translated_recommendation":"Alert","recommendation_reason_text":"Unusual activity from a suspicious device using the Tor browser","recommendation_reason_id":71,"risk_score":114,"resolution_id":"zguiblxuursugnjtulwawxhcmwixsfbs","policy_manager_recommendation":null,"policy_manager_reason":null,"policy_manager_reason_id":null,"policy_manager_risk_score":null,"persistent_device_id":"N/A","new_device_indication_zero_one":0,"country":"US","region":"99","city":null,"isp":"This is some ISP text","organization":"Test Organization","useragent":"Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko","referrer":"/test/test/TAF","x_forwarded_for":"10.10.0.2","screen_resolution":null,"screen_dpi":8,"screen_touch":5,"client_time_zone":0,"rapport_machine_id":"-","client_language":"tr-TR","platform":"Linux x86_64","cpu":"Linux x86_64","os":"Windows 7","accept_encoding":"gzip, deflate, br","mimes":0,"navigator_props":4168486725,"browser_version":"11.0","client_charset":"UTF-8","browser":"IE","accept_charset":"","accept_language":"tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3","network_data":"10.10.0.2","plugins":3,"malware_logical_name":"","infection_severity":"high","malware_signature":null,"formatted_is_targeted":"Maybe","encrypted_user_id":"14D007Bc5cABF5dB23a24CB6CEF7a903f677a43Fbf27EaC34d0bE3242477337f8CF38A65c357b34480AFaBaaC8aBc60d6F8c3B05fdcbB1eDBaaF5fCd5eb8b704Eeac1F05a0a9067cEb9bc0AedA7aa9aF0016D1cA6C2AD3cEF6D22fb6B9E976ffbCcD60652Ca4Fc2EA0A8559AD4bc0c4FfE7c3537Bc3fdacaC9a322c4fC96d5cb05320E7FBAeac5E2a89aD5DAbcBF4575e205bc5a0DF35e06c2026C3df1D8728bAf1aD3120DC0","encryption_key_id":"","app_id":"tma2","customer_session_id":"ADf9FbFe9C01FDc5251FdFeEDCe16Cfa","persistent_user_id":"aaaabbbbcccc0002"}