Skip to content

Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines #24855

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jbfeldman-dd wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines #24855

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
979a137
Map ocsf.src_endpoint.uid in DNS Activity [4003] pipelines
jbfeldman-dd Aug 13, 2026
267a3f1
cisco_umbrella_dns: select the roaming identity for src_endpoint.uid
jbfeldman-dd Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions bluecat_integrity/assets/logs/bluecat-integrity.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -644,6 +644,15 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
sourceType: attribute
target: ocsf.src_endpoint.uid
Comment thread
jbfeldman-dd marked this conversation as resolved.
targetFormat: string
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `sourcePort` to `ocsf.src_endpoint.port`
sources:
- sourcePort
Expand Down
4 changes: 4 additions & 0 deletions bluecat_integrity/assets/logs/bluecat-integrity_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -98,6 +98,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 57895
uid: "10.10.10.10"
time: 1772082904884
payloadType: "dnstap"
requestData:
Expand Down Expand Up @@ -283,6 +284,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 39927
uid: "10.10.10.10"
time: 1771522140526
payloadType: "dnstap"
responseAddress: "10.1.1.1"
Expand Down Expand Up @@ -530,6 +532,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 18456
uid: "10.10.10.10"
time: 1772001594423
payloadType: "dnstap"
queryZone: "google.local."
Expand Down Expand Up @@ -828,6 +831,7 @@ tests:
src_endpoint:
ip: "10.10.10.10"
port: 39927
uid: "10.10.10.10"
time: 1771522140526
payloadType: "dnstap"
requestData:
Expand Down
19 changes: 19 additions & 0 deletions cisco_umbrella_dns/assets/logs/cisco-umbrella-dns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -752,6 +752,15 @@ pipeline:
filter:
query: service:dns
processors:
- type: array-processor
name: Extract roaming computer `id` from `identities` array
enabled: true
operation:
source: identities
target: ocsf.src_endpoint.uid
filter: "type.type:roaming"
valueToExtract: id
type: select
- type: schema-processor
name: Apply OCSF schema for 4003
enabled: true
Expand Down Expand Up @@ -873,6 +882,16 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `ocsf.src_endpoint.uid`, `internalip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.uid
- internalip
sourceType: attribute
target: ocsf.src_endpoint.uid
targetFormat: string
preserveSource: true
overrideOnConflict: false
type: schema-remapper
- name: Map `externalip` to `ocsf.proxy_endpoint.ip`
sources:
- externalip
Expand Down
3 changes: 3 additions & 0 deletions cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
id: cisco-umbrella-dns

Check failure on line 1 in cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml

View check run for this annotation

datadog-assets / validate-logs

Error in logs 

The expected output in the test file does not match the actual pipeline output. The actual pipeline output is :
id: "cisco-umbrella-dns"
tests:
 -
  sample: |-
    {
      "date" : "2023-12-11",
      "returncode" : 0,
      "type" : "dns",
      "internalip" : "185.64.148.0",
      "allapplications" : [ {
        "id" : 989025,
        "label" : "Some APIs",
        "category" : {
          "id" : 1,
          "label" : "Application Development and Testing"
        }
      } ],
      "identities" : [ {
        "deleted" : false,
        "id" : 617808138,
        "label" : "DESKTOP-Example",
        "type" : {
          "id" : 9,
          "label" : "Roaming Computers",
          "type" : "roaming"
        }
      }, {
        "deleted" : false,
        "id" : 617804059,
        "label" : "Test",
        "type" : {
          "id" : 1,
          "label" : "Networks",
          "type" : "network"
        }
      } ],
      "verdict" : "blocked",
      "domain" : "optimizationguide-pa.someapis.com",
      "time" : "09:47:00",
      "policycategories" : [ {
        "deprecated" : false,
        "integration" : false,
        "id" : 190,
        "label" : "Search Engines and Portals",
        "type" : "content"
      } ],
      "categories" : [ {
        "deprecated" : true,
        "integration" : false,
        "id" : 23,
        "label" : "Search Engines",
        "type" : "content"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 148,
        "label" : "Application",
        "type" : "application"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 190,
        "label" : "Search Engines and Portals",
        "type" : "content"
      } ],
      "externalip" : "185.64.148.0",
      "querytype" : "A",
      "timestamp" : 1702288020000
    }
  result:
    custom:
      allapplications:
       -
        category:
          id: 1
          label: "Application Development and Testing"
        id: 989025
        label: "Some APIs"
      categories:
       -
        deprecated: true
        id: 23
        integration: false
        label: "Search Engines"
        type: "content"
       -
        deprecated: false
        id: 148
        integration: false
        label: "Application"
        type: "application"
       -
        deprecated: false
        id: 190
        integration: false
        label: "Search Engines and Portals"
        type: "content"
      cisco:
        umbrella:
          dns:
            external:
              geoip:
                country:
                  iso_code: "FR"
      date: "2023-12-11"
      dns:
        answer:
          type: "A"
        flags:
          rcode: 0
        question:
          name: "optimizationguide-pa.someapis.com"
      domain: "optimizationguide-pa.someapis.com"
      external:
        geoip:
          city:
            name: "Paris"
          continent:
            code: "EU"
            name: "Europe"
          country:
            iso_code: "FR"
            name: "France"
          ipAddress: "185.64.148.0"
          location:
            latitude: 48.90654
            longitude: 2.33339
          subdivision:
            iso_code: "FR-IDF"
            name: "Île-de-France"
          timezone: "Europe/Paris"
      externalip: "185.64.148.0"
      identities:
       -
        deleted: false
        id: 617808138
        label: "DESKTOP-Example"
        type:
          id: 9
          label: "Roaming Computers"
          type: "roaming"
       -
        deleted: false
        id: 617804059
        label: "Test"
        type:
          id: 1
          label: "Networks"
          type: "network"
      internalip: "185.64.148.0"
      ocsf:
        activity_id: 6
        activity_name: "Traffic"
        category_name: "Network Activity"
        category_uid: 4
        class_name: "DNS Activity"
        class_uid: 4003
        metadata:
          product:
            name: "Cisco Umbrella"
            vendor_name: "Cisco"
          profiles:
           - "network_proxy"
          version: "1.5.0"
        proxy_endpoint:
          ip: "185.64.148.0"
        query:
          hostname: "optimizationguide-pa.someapis.com"
          type: "A"
        rcode: "NoError"
        rcode_id: 0
        severity: "Informational"
        severity_id: 1
        src_endpoint:
          ip: "185.64.148.0"
          uid: 617808138
        status: "Failure"
        status_id: 2
        time: 1702288020000
      policycategories:
       -
        deprecated: false
        id: 190
        integration: false
        label: "Search Engines and Portals"
        type: "content"
      querytype: "A"
      returncode: 0
      returnmessage: "NOERROR"
      time: "09:47:00"
      timestamp: 1702288020000
      type: "dns"
      verdict: "blocked"
    message: |-
      {
        "date" : "2023-12-11",
        "returncode" : 0,
        "type" : "dns",
        "internalip" : "185.64.148.0",
        "allapplications" : [ {
          "id" : 989025,
          "label" : "Some APIs",
          "category" : {
            "id" : 1,
            "label" : "Application Development and Testing"
          }
        } ],
        "identities" : [ {
          "deleted" : false,
          "id" : 617808138,
          "label" : "DESKTOP-Example",
          "type" : {
            "id" : 9,
            "label" : "Roaming Computers",
            "type" : "roaming"
          }
        }, {
          "deleted" : false,
          "id" : 617804059,
          "label" : "Test",
          "type" : {
            "id" : 1,
            "label" : "Networks",
            "type" : "network"
          }
        } ],
        "verdict" : "blocked",
        "domain" : "optimizationguide-pa.someapis.com",
        "time" : "09:47:00",
        "policycategories" : [ {
          "deprecated" : false,
          "integration" : false,
          "id" : 190,
          "label" : "Search Engines and Portals",
          "type" : "content"
        } ],
        "categories" : [ {
          "deprecated" : true,
          "integration" : false,
          "id" : 23,
          "label" : "Search Engines",
          "type" : "content"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 148,
          "label" : "Application",
          "type" : "application"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 190,
          "label" : "Search Engines and Portals",
          "type" : "content"
        } ],
        "externalip" : "185.64.148.0",
        "querytype" : "A",
        "timestamp" : 1702288020000
      }
    service: "dns"
    tags:
     - "source:LOGS_SOURCE"
    timestamp: 1702288020000

Check failure on line 1 in cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml

View check run for this annotation

datadog-assets / validate-logs

Error in logs 

The expected output in the test file does not match the actual pipeline output. The actual pipeline output is :
id: "cisco-umbrella-dns"
tests:
 -
  sample: |-
    {
      "date" : "2023-12-19",
      "returncode" : 0,
      "type" : "dns",
      "internalip" : "185.64.148.0",
      "allapplications" : [ {
        "id" : 992107,
        "label" : "test.com",
        "category" : {
          "id" : 47,
          "label" : "Media"
        }
      } ],
      "identities" : [ {
        "deleted" : false,
        "id" : 618368586,
        "label" : "DESKTOP-Name",
        "type" : {
          "id" : 9,
          "label" : "Roaming Computers",
          "type" : "roaming"
        }
      } ],
      "verdict" : "allowed",
      "domain" : "test.com",
      "time" : "12:56:56",
      "policycategories" : [ {
        "deprecated" : false,
        "integration" : false,
        "id" : 194,
        "label" : "Streaming Video",
        "type" : "content"
      } ],
      "categories" : [ {
        "deprecated" : true,
        "integration" : false,
        "id" : 17,
        "label" : "Movies",
        "type" : "content"
      }, {
        "deprecated" : true,
        "integration" : false,
        "id" : 26,
        "label" : "Television",
        "type" : "content"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 148,
        "label" : "Application",
        "type" : "application"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 194,
        "label" : "Streaming Video",
        "type" : "content"
      } ],
      "externalip" : "185.64.148.0",
      "querytype" : "A",
      "timestamp" : 1702990616000
    }
  result:
    custom:
      allapplications:
       -
        category:
          id: 47
          label: "Media"
        id: 992107
        label: "test.com"
      categories:
       -
        deprecated: true
        id: 17
        integration: false
        label: "Movies"
        type: "content"
       -
        deprecated: true
        id: 26
        integration: false
        label: "Television"
        type: "content"
       -
        deprecated: false
        id: 148
        integration: false
        label: "Application"
        type: "application"
       -
        deprecated: false
        id: 194
        integration: false
        label: "Streaming Video"
        type: "content"
      cisco:
        umbrella:
          dns:
            external:
              geoip:
                country:
                  iso_code: "FR"
      date: "2023-12-19"
      dns:
        answer:
          type: "A"
        flags:
          rcode: 0
        question:
          name: "test.com"
      domain: "test.com"
      external:
        geoip:
          city:
            name: "Paris"
          continent:
            code: "EU"
            name: "Europe"
          country:
            iso_code: "FR"
            name: "France"
          ipAddress: "185.64.148.0"
          location:
            latitude: 48.90654
            longitude: 2.33339
          subdivision:
            iso_code: "FR-IDF"
            name: "Île-de-France"
          timezone: "Europe/Paris"
      externalip: "185.64.148.0"
      identities:
       -
        deleted: false
        id: 618368586
        label: "DESKTOP-Name"
        type:
          id: 9
          label: "Roaming Computers"
          type: "roaming"
      internalip: "185.64.148.0"
      ocsf:
        activity_id: 6
        activity_name: "Traffic"
        category_name: "Network Activity"
        category_uid: 4
        class_name: "DNS Activity"
        class_uid: 4003
        metadata:
          product:
            name: "Cisco Umbrella"
            vendor_name: "Cisco"
          profiles:
           - "network_proxy"
          version: "1.5.0"
        proxy_endpoint:
          ip: "185.64.148.0"
        query:
          hostname: "test.com"
          type: "A"
        rcode: "NoError"
        rcode_id: 0
        severity: "Informational"
        severity_id: 1
        src_endpoint:
          ip: "185.64.148.0"
          uid: 618368586
        status: "Success"
        status_id: 1
        time: 1702990616000
      policycategories:
       -
        deprecated: false
        id: 194
        integration: false
        label: "Streaming Video"
        type: "content"
      querytype: "A"
      returncode: 0
      returnmessage: "NOERROR"
      time: "12:56:56"
      timestamp: 1702990616000
      type: "dns"
      verdict: "allowed"
    message: |-
      {
        "date" : "2023-12-19",
        "returncode" : 0,
        "type" : "dns",
        "internalip" : "185.64.148.0",
        "allapplications" : [ {
          "id" : 992107,
          "label" : "test.com",
          "category" : {
            "id" : 47,
            "label" : "Media"
          }
        } ],
        "identities" : [ {
          "deleted" : false,
          "id" : 618368586,
          "label" : "DESKTOP-Name",
          "type" : {
            "id" : 9,
            "label" : "Roaming Computers",
            "type" : "roaming"
          }
        } ],
        "verdict" : "allowed",
        "domain" : "test.com",
        "time" : "12:56:56",
        "policycategories" : [ {
          "deprecated" : false,
          "integration" : false,
          "id" : 194,
          "label" : "Streaming Video",
          "type" : "content"
        } ],
        "categories" : [ {
          "deprecated" : true,
          "integration" : false,
          "id" : 17,
          "label" : "Movies",
          "type" : "content"
        }, {
          "deprecated" : true,
          "integration" : false,
          "id" : 26,
          "label" : "Television",
          "type" : "content"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 148,
          "label" : "Application",
          "type" : "application"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 194,
          "label" : "Streaming Video",
          "type" : "content"
        } ],
        "externalip" : "185.64.148.0",
        "querytype" : "A",
        "timestamp" : 1702990616000
      }
    service: "dns"
    tags:
     - "source:LOGS_SOURCE"
    timestamp: 1702990616000

Check failure on line 1 in cisco_umbrella_dns/assets/logs/cisco-umbrella-dns_tests.yaml

View check run for this annotation

datadog-assets / validate-logs

Error in logs 

The expected output in the test file does not match the actual pipeline output. The actual pipeline output is :
id: "cisco-umbrella-dns"
tests:
 -
  sample: |-
    {
      "date" : "2023-12-19",
      "returncode" : 0,
      "type" : "dns",
      "internalip" : "185.64.148.0",
      "allapplications" : [ {
        "id" : 987820,
        "label" : "Social Media Platform",
        "category" : {
          "id" : 33,
          "label" : "Social Networking"
        }
      } ],
      "identities" : [ {
        "deleted" : false,
        "id" : 618368586,
        "label" : "DESKTOP-Test",
        "type" : {
          "id" : 9,
          "label" : "Roaming Computers",
          "type" : "roaming"
        }
      } ],
      "verdict" : "proxied",
      "domain" : "instagram.com",
      "time" : "12:56:56",
      "policycategories" : [ {
        "deprecated" : false,
        "integration" : false,
        "id" : 24,
        "label" : "Social Networking",
        "type" : "content"
      } ],
      "categories" : [ {
        "deprecated" : true,
        "integration" : false,
        "id" : 20,
        "label" : "Photo Sharing",
        "type" : "content"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 24,
        "label" : "Social Networking",
        "type" : "content"
      }, {
        "deprecated" : false,
        "integration" : false,
        "id" : 148,
        "label" : "Application",
        "type" : "application"
      } ],
      "externalip" : "185.64.148.0",
      "querytype" : "A",
      "timestamp" : 1702990616000
    }
  result:
    custom:
      allapplications:
       -
        category:
          id: 33
          label: "Social Networking"
        id: 987820
        label: "Social Media Platform"
      categories:
       -
        deprecated: true
        id: 20
        integration: false
        label: "Photo Sharing"
        type: "content"
       -
        deprecated: false
        id: 24
        integration: false
        label: "Social Networking"
        type: "content"
       -
        deprecated: false
        id: 148
        integration: false
        label: "Application"
        type: "application"
      cisco:
        umbrella:
          dns:
            external:
              geoip:
                country:
                  iso_code: "FR"
      date: "2023-12-19"
      dns:
        answer:
          type: "A"
        flags:
          rcode: 0
        question:
          name: "instagram.com"
      domain: "instagram.com"
      external:
        geoip:
          city:
            name: "Paris"
          continent:
            code: "EU"
            name: "Europe"
          country:
            iso_code: "FR"
            name: "France"
          ipAddress: "185.64.148.0"
          location:
            latitude: 48.90654
            longitude: 2.33339
          subdivision:
            iso_code: "FR-IDF"
            name: "Île-de-France"
          timezone: "Europe/Paris"
      externalip: "185.64.148.0"
      identities:
       -
        deleted: false
        id: 618368586
        label: "DESKTOP-Test"
        type:
          id: 9
          label: "Roaming Computers"
          type: "roaming"
      internalip: "185.64.148.0"
      ocsf:
        activity_id: 6
        activity_name: "Traffic"
        category_name: "Network Activity"
        category_uid: 4
        class_name: "DNS Activity"
        class_uid: 4003
        metadata:
          product:
            name: "Cisco Umbrella"
            vendor_name: "Cisco"
          profiles:
           - "network_proxy"
          version: "1.5.0"
        proxy_endpoint:
          ip: "185.64.148.0"
        query:
          hostname: "instagram.com"
          type: "A"
        rcode: "NoError"
        rcode_id: 0
        severity: "Informational"
        severity_id: 1
        src_endpoint:
          ip: "185.64.148.0"
          uid: 618368586
        time: 1702990616000
      policycategories:
       -
        deprecated: false
        id: 24
        integration: false
        label: "Social Networking"
        type: "content"
      querytype: "A"
      returncode: 0
      returnmessage: "NOERROR"
      time: "12:56:56"
      timestamp: 1702990616000
      type: "dns"
      verdict: "proxied"
    message: |-
      {
        "date" : "2023-12-19",
        "returncode" : 0,
        "type" : "dns",
        "internalip" : "185.64.148.0",
        "allapplications" : [ {
          "id" : 987820,
          "label" : "Social Media Platform",
          "category" : {
            "id" : 33,
            "label" : "Social Networking"
          }
        } ],
        "identities" : [ {
          "deleted" : false,
          "id" : 618368586,
          "label" : "DESKTOP-Test",
          "type" : {
            "id" : 9,
            "label" : "Roaming Computers",
            "type" : "roaming"
          }
        } ],
        "verdict" : "proxied",
        "domain" : "instagram.com",
        "time" : "12:56:56",
        "policycategories" : [ {
          "deprecated" : false,
          "integration" : false,
          "id" : 24,
          "label" : "Social Networking",
          "type" : "content"
        } ],
        "categories" : [ {
          "deprecated" : true,
          "integration" : false,
          "id" : 20,
          "label" : "Photo Sharing",
          "type" : "content"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 24,
          "label" : "Social Networking",
          "type" : "content"
        }, {
          "deprecated" : false,
          "integration" : false,
          "id" : 148,
          "label" : "Application",
          "type" : "application"
        } ],
        "externalip" : "185.64.148.0",
        "querytype" : "A",
        "timestamp" : 1702990616000
      }
    service: "dns"
    tags:
     - "source:LOGS_SOURCE"
    timestamp: 1702990616000
tests:
-
sample: |-
Expand Down Expand Up @@ -173,6 +173,7 @@
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "617808138"
status: "Failure"
status_id: 2
time: 1702288020000
Expand Down Expand Up @@ -428,6 +429,7 @@
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "618368586"
status: "Success"
status_id: 1
time: 1702990616000
Expand Down Expand Up @@ -668,6 +670,7 @@
severity_id: 1
src_endpoint:
ip: "185.64.148.0"
uid: "618368586"
time: 1702990616000
policycategories:
-
Expand Down
9 changes: 9 additions & 0 deletions coredns/assets/logs/coredns.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -452,6 +452,15 @@ pipeline:
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
sourceType: attribute
target: ocsf.src_endpoint.uid
targetFormat: string
preserveSource: true
overrideOnConflict: true
type: schema-remapper
- name: Map `network.client.port` to `ocsf.src_endpoint.port`
sources:
- network.client.port
Expand Down
2 changes: 2 additions & 0 deletions coredns/assets/logs/coredns_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -59,6 +59,7 @@ tests:
src_endpoint:
ip: "10.145.105.176"
port: 36008
uid: "10.145.105.176"
status: "Failure"
status_code: "NXDOMAIN"
status_id: 2
Expand Down Expand Up @@ -127,6 +128,7 @@ tests:
src_endpoint:
ip: "127.0.0.1"
port: 50759
uid: "127.0.0.1"
status: "Success"
status_code: "NOERROR"
status_id: 1
Expand Down
8 changes: 8 additions & 0 deletions zeek/assets/logs/zeek.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3505,6 +3505,14 @@ pipeline:
target: ocsf.src_endpoint.ip
preserveSource: true
overrideOnConflict: true
- type: schema-remapper
name: Map `ocsf.src_endpoint.ip` to `ocsf.src_endpoint.uid`
sources:
- ocsf.src_endpoint.ip
target: ocsf.src_endpoint.uid
preserveSource: true
overrideOnConflict: true
targetFormat: string
- type: schema-remapper
name: Map `id.orig_p` to `ocsf.src_endpoint.port`
sources:
Expand Down
3 changes: 3 additions & 0 deletions zeek/assets/logs/zeek_tests.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -417,6 +417,7 @@ tests:
src_endpoint:
ip: 185.64.148.0
port: 58013
uid: 185.64.148.0
status: Success
status_detail: NOERROR
status_id: 1
Expand Down Expand Up @@ -565,6 +566,7 @@ tests:
src_endpoint:
ip: 10.10.10.10
port: 123
uid: 10.10.10.10
status: Unknown
status_id: 0
time: 1709786320085
Expand Down Expand Up @@ -1090,6 +1092,7 @@ tests:
src_endpoint:
ip: 185.64.148.0
port: 58013
uid: 185.64.148.0
status: Success
status_detail: NOERROR
status_id: 1
Expand Down
Loading