-
Notifications
You must be signed in to change notification settings - Fork 5
/
logs.log
3123 lines (3123 loc) · 598 KB
/
logs.log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
2024-04-02 11:10:00,387 - file - DEBUG - Debug FILE -- App Started
2024-04-02 11:10:01,052 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-02 11:11:33,718 - file - DEBUG - mqtt -- msg received ***
2024-04-02 11:11:33,719 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 11:11:33,719 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "bed68f014ad34817b035856507751a20", "created": 1712070692572, "from": "OIF Orchestrator 2", "actuator_id": "bed68f014ad34817b035856507751a20"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-4.jhf"}}, "args": {"th": {"huntargs": {"string_args": ["filename_1:siblings.json", "filename_2:hosts.json"]}}}}}}}
2024-04-02 11:11:33,745 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-02 11:11:33,746 - kestrel.config - DEBUG - Loading default config file...
2024-04-02 11:11:33,770 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-02 11:11:33,770 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-02 11:11:33,770 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-02 11:11:33,772 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-00fe82cb-cd27-43b5-8e03-40d11eb7a3c0.
2024-04-02 11:11:35,384 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-02 11:11:37,378 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 20, 'relation': 'eq'}
2024-04-02 11:11:37,378 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 20
2024-04-02 11:11:37,410 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 20, 'relation': 'eq'}
2024-04-02 11:11:37,410 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-02 11:11:38,161 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-02 11:11:38,175 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch nt_local.
2024-04-02 11:11:38,176 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-02 11:11:38,236 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-02 11:11:40,132 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 37, 'relation': 'eq'}
2024-04-02 11:11:40,132 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 37
2024-04-02 11:11:40,171 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 37, 'relation': 'eq'}
2024-04-02 11:11:40,172 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-02 11:11:41,799 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch nt_fw_local.
2024-04-02 11:11:41,799 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-02 11:11:41,807 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch remoteip_local.
2024-04-02 11:11:42,071 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [ipv4-addr:value IN ('172.16.1.14','172.16.1.13')] START t'2024-03-06T16:04:53.000Z' STOP t'2024-03-06T19:02:34.839Z'
2024-04-02 11:11:42,121 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-02 11:11:43,982 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 121, 'relation': 'eq'}
2024-04-02 11:11:43,982 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 121
2024-04-02 11:11:44,011 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 121, 'relation': 'eq'}
2024-04-02 11:11:44,012 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-02 11:11:45,026 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 11:11:45,026 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 11:11:45,027 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "bed68f014ad34817b035856507751a20", "created": 1712070705025, "from": "oif-device-priapus-1712070600366", "actuator_id": "bed68f014ad34817b035856507751a20"}, "body": {"openc2": {"response": {"status": 200, "results": {"remoteip": {"value": "172.16.1.14", "id": "ipv4-addr--63150511-f347-50d6-bb0d-e7d9ac7bd017", "type": "ipv4-addr"}}}}}}
2024-04-02 11:27:50,812 - file - DEBUG - mqtt -- msg received ***
2024-04-02 11:27:50,812 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 11:27:50,813 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a6c2d313211e4228a62fc13d646f6ff7", "created": 1712071669635, "from": "OIF Orchestrator 2", "actuator_id": "a6c2d313211e4228a62fc13d646f6ff7"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 11:30:44,660 - file - DEBUG - Debug FILE -- App Started
2024-04-02 11:30:45,410 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-02 11:30:59,122 - file - DEBUG - mqtt -- msg received ***
2024-04-02 11:30:59,123 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 11:30:59,123 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a9ca4320579a46c689458b3a5f4b6378", "created": 1712071857963, "from": "OIF Orchestrator 2", "actuator_id": "a9ca4320579a46c689458b3a5f4b6378"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 11:31:16,393 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 11:31:16,393 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 11:31:16,393 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a9ca4320579a46c689458b3a5f4b6378", "created": 1712071876389, "from": "oif-device-priapus-1712071844641", "actuator_id": "a9ca4320579a46c689458b3a5f4b6378"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:11:47,107 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:11:47,107 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:11:47,108 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "e257d7378bff40068310dfbe145bcc13", "created": 1712077905985, "from": "OIF Orchestrator 2", "actuator_id": "e257d7378bff40068310dfbe145bcc13"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:11:51,836 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:11:51,836 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:11:51,836 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "e257d7378bff40068310dfbe145bcc13", "created": 1712077911833, "from": "oif-device-priapus-1712071844641", "actuator_id": "e257d7378bff40068310dfbe145bcc13"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:17:59,866 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:17:59,867 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:17:59,867 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "129926d54baa41a2be2a1d2cacfb2339", "created": 1712078278740, "from": "OIF Orchestrator 2", "actuator_id": "129926d54baa41a2be2a1d2cacfb2339"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:17:59,889 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:17:59,890 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:17:59,890 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "129926d54baa41a2be2a1d2cacfb2339", "created": 1712078279888, "from": "oif-device-priapus-1712071844641", "actuator_id": "129926d54baa41a2be2a1d2cacfb2339"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:30:19,661 - file - DEBUG - Debug FILE -- App Started
2024-04-02 13:30:20,494 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-02 13:30:55,734 - file - DEBUG - Debug FILE -- App Started
2024-04-02 13:30:56,334 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-02 13:34:24,913 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:34:24,913 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:34:24,913 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "2de4d40f27634b04bda5b9349770f026", "created": 1712079259801, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:34:24,950 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:34:24,951 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:34:24,951 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "2de4d40f27634b04bda5b9349770f026", "created": 1712079264947, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:41:51,369 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:41:51,369 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:41:51,370 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "47004cedde8f47ca99fb2ba41dc80b2d", "created": 1712079710204, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:41:51,401 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:41:51,402 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:41:51,402 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "47004cedde8f47ca99fb2ba41dc80b2d", "created": 1712079711400, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:50:17,014 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:50:17,014 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:50:17,014 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "91b1ec72b8bc4a3aa4f9c347465aa181", "created": 1712080215831, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:50:17,043 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:50:17,043 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:50:17,044 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "91b1ec72b8bc4a3aa4f9c347465aa181", "created": 1712080217042, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 13:59:09,486 - file - DEBUG - mqtt -- msg received ***
2024-04-02 13:59:09,486 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 13:59:09,486 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "48ce7b565e114495b19ec412d833a25d", "created": 1712080748311, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 13:59:09,512 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 13:59:09,512 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 13:59:09,512 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "48ce7b565e114495b19ec412d833a25d", "created": 1712080749510, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:00:04,372 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:00:04,372 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:00:04,372 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b8a7452d5b754d9a8c12351ae473103e", "created": 1712080803231, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:00:04,420 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:00:04,420 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:00:04,421 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b8a7452d5b754d9a8c12351ae473103e", "created": 1712080804416, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:00:16,660 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:00:16,660 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:00:16,660 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b07cc5bc78ee41c2b5b6fd2b9f34032b", "created": 1712080815460, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:00:16,695 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:00:16,695 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:00:16,695 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b07cc5bc78ee41c2b5b6fd2b9f34032b", "created": 1712080816693, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:00:38,163 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:00:38,164 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:00:38,164 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "9f01fd3aa4154aa1ac09bede465a7f29", "created": 1712080836983, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:00:38,189 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:00:38,189 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:00:38,189 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "9f01fd3aa4154aa1ac09bede465a7f29", "created": 1712080838188, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:02:03,052 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:02:03,052 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:02:03,052 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "8e61090d378d4cbea5463fb969d3ad7e", "created": 1712080921900, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:02:03,084 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:02:03,084 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:02:03,084 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "8e61090d378d4cbea5463fb969d3ad7e", "created": 1712080923082, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:03:03,673 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:03:03,673 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:03:03,674 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "36393c3d3e3b4bdea48c469e818458a4", "created": 1712080982500, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:03:03,700 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:03:03,700 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:03:03,700 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "36393c3d3e3b4bdea48c469e818458a4", "created": 1712080983699, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:03:15,960 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:03:15,960 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:03:15,961 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "7d6b9417e0d044a9b515f29a31269250", "created": 1712080994795, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:03:15,988 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:03:15,989 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:03:15,989 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "7d6b9417e0d044a9b515f29a31269250", "created": 1712080995987, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:08:00,370 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:08:00,370 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:08:00,371 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "c5c1f358e5e3460290ed9d9d3e6fde88", "created": 1712081279247, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:08:00,435 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:08:00,436 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:08:00,436 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "c5c1f358e5e3460290ed9d9d3e6fde88", "created": 1712081280432, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:09:01,786 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:09:01,786 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:09:01,786 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "62cc443dc2d1412ea97031858a5553fa", "created": 1712081340667, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:09:01,821 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:09:01,821 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:09:01,822 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "62cc443dc2d1412ea97031858a5553fa", "created": 1712081341819, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:12:38,949 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:12:38,949 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:12:38,949 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "bda7585ff6c144a9b4a58b644492d2d6", "created": 1712081557824, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:12:38,990 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:12:38,990 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:12:38,990 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "bda7585ff6c144a9b4a58b644492d2d6", "created": 1712081558987, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:16:02,725 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:16:02,725 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:16:02,725 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "dd8ad97fe8c240d79ea0b9f93608cea8", "created": 1712081761523, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:16:02,760 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:16:02,760 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:16:02,761 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "dd8ad97fe8c240d79ea0b9f93608cea8", "created": 1712081762759, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:19:58,651 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:19:58,652 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:19:58,652 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "04d05efba3cf4dbd98205bd8e4ce2e59", "created": 1712081997499, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:19:58,684 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:19:58,684 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:19:58,684 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "04d05efba3cf4dbd98205bd8e4ce2e59", "created": 1712081998682, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:21:08,385 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:21:08,385 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:21:08,385 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "498103b2bbce434f95492553dccc61a1", "created": 1712082067160, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:21:08,419 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:21:08,419 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:21:08,419 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "498103b2bbce434f95492553dccc61a1", "created": 1712082068417, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:28:34,742 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:28:34,742 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:28:34,743 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "347fde4cc44f49c49f80085d318c578a", "created": 1712082502011, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:28:34,783 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:28:34,783 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:28:34,783 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "347fde4cc44f49c49f80085d318c578a", "created": 1712082514780, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:36:32,942 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:36:32,945 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:36:32,945 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "3a57704a60344e43b4cf10c5dbe5ac02", "created": 1712082991789, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:36:33,076 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:36:33,076 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:36:33,077 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "3a57704a60344e43b4cf10c5dbe5ac02", "created": 1712082993075, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:37:11,044 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:37:11,044 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:37:11,044 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "d1c5140c8e9e4d7187298339f4cfa7b0", "created": 1712083029922, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:37:11,073 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:37:11,073 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:37:11,073 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "d1c5140c8e9e4d7187298339f4cfa7b0", "created": 1712083031071, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:41:56,010 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:41:56,011 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:41:56,011 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "98440dad7c4f4251850985f63f02bfeb", "created": 1712083314816, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:41:56,043 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:41:56,043 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:41:56,043 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "98440dad7c4f4251850985f63f02bfeb", "created": 1712083316041, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 14:43:17,931 - file - DEBUG - mqtt -- msg received ***
2024-04-02 14:43:17,931 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 14:43:17,931 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "095513461a204422a9365e81e1ad526d", "created": 1712083396748, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 14:43:17,980 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 14:43:17,980 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 14:43:17,981 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "095513461a204422a9365e81e1ad526d", "created": 1712083397974, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:22:33,619 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:22:33,622 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:22:33,622 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "9ac52cf64d4a459690c8feb199937ef5", "created": 1712085752362, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:22:33,765 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:22:33,765 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:22:33,765 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "9ac52cf64d4a459690c8feb199937ef5", "created": 1712085753763, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:26:48,423 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:26:48,424 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:26:48,424 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b0f3e91fc0f647899c1b9c8fbb1a6375", "created": 1712086007298, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:26:48,460 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:26:48,461 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:26:48,461 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b0f3e91fc0f647899c1b9c8fbb1a6375", "created": 1712086008459, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:39:46,515 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:39:46,518 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:39:46,519 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "4f6440bdc4784daaa76f8765cd51260a", "created": 1712086785376, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:39:46,618 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:39:46,618 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:39:46,618 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "4f6440bdc4784daaa76f8765cd51260a", "created": 1712086786614, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:42:49,501 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:42:49,502 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:42:49,502 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "30d6fb92ad0e4a5f974d299ad6daf2f1", "created": 1712086968288, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:42:49,528 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:42:49,528 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:42:49,529 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "30d6fb92ad0e4a5f974d299ad6daf2f1", "created": 1712086969526, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:44:04,354 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:44:04,355 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:44:04,355 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "67cd1dd6f0e84c9693eae46d0564376f", "created": 1712087043154, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:44:04,388 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:44:04,388 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:44:04,389 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "67cd1dd6f0e84c9693eae46d0564376f", "created": 1712087044386, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:44:47,261 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:44:47,262 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:44:47,262 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "8465956b0b884be7b5a72c3efa52844b", "created": 1712087086027, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:44:47,305 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:44:47,305 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:44:47,305 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "8465956b0b884be7b5a72c3efa52844b", "created": 1712087087304, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:47:16,043 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:47:16,043 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:47:16,043 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "e7a17e683d5e4faba284c109b39c999d", "created": 1712087234842, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:47:16,067 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:47:16,067 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:47:16,067 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "e7a17e683d5e4faba284c109b39c999d", "created": 1712087236066, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 15:52:07,262 - file - DEBUG - mqtt -- msg received ***
2024-04-02 15:52:07,262 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 15:52:07,262 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "6c1bcabd57d846169a3ca93f821b9abf", "created": 1712087526122, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 15:52:07,297 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 15:52:07,297 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 15:52:07,298 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "6c1bcabd57d846169a3ca93f821b9abf", "created": 1712087527293, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:01:43,660 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:01:43,660 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:01:43,660 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "e4b70f56ca284c48b1bc1669da915a18", "created": 1712088102448, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:01:43,683 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:01:43,683 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:01:43,683 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "e4b70f56ca284c48b1bc1669da915a18", "created": 1712088103682, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:04:06,710 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:04:06,710 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:04:06,710 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "0d3d07a2e71e4ccc877d223bbd8e3671", "created": 1712088245507, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:04:06,754 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:04:06,754 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:04:06,754 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "0d3d07a2e71e4ccc877d223bbd8e3671", "created": 1712088246751, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:10:31,264 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:10:31,264 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:10:31,265 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "429c0f1e6525414396f352d851809a1f", "created": 1712088630143, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:10:31,309 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:10:31,309 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:10:31,309 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "429c0f1e6525414396f352d851809a1f", "created": 1712088631305, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:12:23,616 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:12:23,617 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:12:23,617 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "729fcfbb7c8546809dae3f1cc67c0e9e", "created": 1712088742488, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:12:23,647 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:12:23,647 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:12:23,648 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "729fcfbb7c8546809dae3f1cc67c0e9e", "created": 1712088743644, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:14:03,784 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:14:03,784 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:14:03,784 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "1e6546c224634753994d32d2dc5ba8cf", "created": 1712088842663, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:14:03,835 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:14:03,836 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:14:03,836 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "1e6546c224634753994d32d2dc5ba8cf", "created": 1712088843832, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:14:26,428 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:14:26,428 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:14:26,429 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b3dcf8ae7a814aac862ad90696fb4e76", "created": 1712088865308, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:14:26,485 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:14:26,487 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:14:26,488 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b3dcf8ae7a814aac862ad90696fb4e76", "created": 1712088866477, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:15:20,489 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:15:20,489 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:15:20,489 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b03c7612377842489f7cb97ae51c37c2", "created": 1712088919310, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:15:20,575 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:15:20,576 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:15:20,576 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b03c7612377842489f7cb97ae51c37c2", "created": 1712088920573, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:17:15,189 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:17:15,189 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:17:15,190 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "c510885316bc4643ad989b50b251693d", "created": 1712089034057, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:17:15,233 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:17:15,233 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:17:15,233 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "c510885316bc4643ad989b50b251693d", "created": 1712089035231, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-02 16:39:23,063 - file - DEBUG - mqtt -- msg received ***
2024-04-02 16:39:23,063 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-02 16:39:23,063 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a48442b5b59d49639ad0a80c6bd96506", "created": 1712090361936, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-02 16:39:23,111 - file - DEBUG - mqtt -- publishing msg ***
2024-04-02 16:39:23,111 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-02 16:39:23,112 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a48442b5b59d49639ad0a80c6bd96506", "created": 1712090363107, "from": "oif-device-priapus-1712079055710"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 14:51:24,185 - file - DEBUG - Debug FILE -- App Started
2024-04-03 14:51:24,573 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-03 14:51:42,787 - file - DEBUG - mqtt -- msg received ***
2024-04-03 14:51:42,787 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 14:51:42,787 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a60e50716184489eb22263f807b335e5", "created": 1712170301670, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 14:51:42,900 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 14:51:42,900 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 14:51:42,901 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a60e50716184489eb22263f807b335e5", "created": 1712170302897, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 14:52:20,698 - file - DEBUG - mqtt -- msg received ***
2024-04-03 14:52:20,698 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 14:52:20,698 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "cd48f8a75ac344f38a3d7e3e8f5857a0", "created": 1712170339579, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 14:52:20,754 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 14:52:20,755 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 14:52:20,755 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "cd48f8a75ac344f38a3d7e3e8f5857a0", "created": 1712170340751, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 14:53:04,033 - file - DEBUG - mqtt -- msg received ***
2024-04-03 14:53:04,033 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 14:53:04,033 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "064d896bb3c9483ab47dcbcb6b90172a", "created": 1712170382912, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 14:53:04,067 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 14:53:04,067 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 14:53:04,067 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "064d896bb3c9483ab47dcbcb6b90172a", "created": 1712170384062, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 14:59:46,870 - file - DEBUG - mqtt -- msg received ***
2024-04-03 14:59:46,870 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 14:59:46,870 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "d1012c714a634ca892a40fefe4d5ba01", "created": 1712170785754, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 14:59:46,966 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 14:59:46,967 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 14:59:46,967 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "d1012c714a634ca892a40fefe4d5ba01", "created": 1712170786965, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:09:37,762 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:09:37,762 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:09:37,762 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b1f52d739b864b98a54f163e71657b48", "created": 1712171376611, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:09:37,796 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:09:37,796 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:09:37,797 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b1f52d739b864b98a54f163e71657b48", "created": 1712171377795, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:12:05,629 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:12:05,629 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:12:05,629 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "9f8c281aa654446b94e6e40ddb935796", "created": 1712171524450, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:12:05,672 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:12:05,672 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:12:05,672 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "9f8c281aa654446b94e6e40ddb935796", "created": 1712171525669, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:14:16,982 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:14:16,983 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:14:16,983 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "f30491cac5354b8aa72cfec634e7d159", "created": 1712171655867, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:14:17,012 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:14:17,013 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:14:17,013 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "f30491cac5354b8aa72cfec634e7d159", "created": 1712171657010, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:14:17,792 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:14:17,792 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:14:17,792 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "d51d45e4-adcd-46b0-b595-35126b5d39a4", "from": "mqtt_tester-MacBook-Pro.local-1712171656561", "to": "test_receiver", "created": 1712171656562}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-03 15:14:17,823 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-03 15:14:17,825 - kestrel.config - DEBUG - Loading default config file...
2024-04-03 15:14:17,849 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-03 15:14:17,850 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-03 15:14:17,850 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-03 15:14:17,851 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-768d18b6-33a1-45fa-baa0-d064670c4d07.
2024-04-03 15:14:20,044 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:14:22,098 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:14:22,099 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-03 15:14:22,140 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:14:22,141 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:14:23,325 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-03 15:14:23,616 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-04T19:14:19.713Z' STOP t'2024-04-03T19:14:19.713Z'
2024-04-03 15:14:23,675 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:14:25,429 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:14:25,429 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-03 15:14:25,460 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:14:25,460 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:14:26,002 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-03 15:14:26,322 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-04T19:14:19.731Z' STOP t'2024-04-03T19:14:19.731Z'
2024-04-03 15:14:26,366 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:14:28,414 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:28,415 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:28,651 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:28,652 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:28,892 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:28,893 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:29,157 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:29,158 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:29,360 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:29,362 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:29,749 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:29,750 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:29,984 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:29,985 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:30,184 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:30,185 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:30,511 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:30,512 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:30,814 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:30,815 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:31,066 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:31,067 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:14:31,119 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:31,120 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-03 15:14:31,159 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:14:31,160 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:15:13,527 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:15:13,527 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:15:13,527 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "d51d45e4-adcd-46b0-b595-35126b5d39a4", "created": 1712171713521, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-03 15:15:39,031 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:15:39,031 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:15:39,031 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "77617443-d194-4994-8870-f419500d5469", "from": "mqtt_tester-MacBook-Pro.local-1712171738018", "to": "test_receiver", "created": 1712171738019}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-03 15:15:39,053 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-03 15:15:39,054 - kestrel.config - DEBUG - Loading default config file...
2024-04-03 15:15:39,087 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-03 15:15:39,087 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-03 15:15:39,088 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-03 15:15:39,089 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-dfbe7043-0bb9-4725-9d54-37027bff6502.
2024-04-03 15:15:40,005 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:15:41,797 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:15:41,798 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-03 15:15:41,841 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:15:41,841 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:15:43,484 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-03 15:15:43,815 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-04T19:15:39.952Z' STOP t'2024-04-03T19:15:39.952Z'
2024-04-03 15:15:43,858 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:15:45,585 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:15:45,586 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-03 15:15:45,612 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:15:45,613 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:15:46,190 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-03 15:15:46,452 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-04T19:15:39.953Z' STOP t'2024-04-03T19:15:39.953Z'
2024-04-03 15:15:46,491 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:15:48,396 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:48,397 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:48,738 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:48,739 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:48,953 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:48,954 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:49,182 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:49,183 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:49,376 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:49,377 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:49,610 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:49,611 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:49,891 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:49,892 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:50,186 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:50,187 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:50,461 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:50,462 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:50,730 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:50,731 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:51,102 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:51,103 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:15:51,159 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:51,160 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-03 15:15:51,201 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:15:51,201 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:16:36,018 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:16:36,018 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:16:36,018 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "77617443-d194-4994-8870-f419500d5469", "created": 1712171796008, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-03 15:17:45,396 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:17:45,396 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:17:45,396 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "3de6e3ebefef4da4a0b7aaf918415efd", "created": 1712171864167, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:17:45,433 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:17:45,433 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:17:45,433 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "3de6e3ebefef4da4a0b7aaf918415efd", "created": 1712171865431, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:22:47,372 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:22:47,373 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:22:47,373 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "39dd21288cd44d64ac35874b8da6b93e", "created": 1712172166163, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:22:47,417 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:22:47,418 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:22:47,418 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "39dd21288cd44d64ac35874b8da6b93e", "created": 1712172167416, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:25:31,131 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:25:31,131 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:25:31,132 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "78fe6366301d4726ac8224c6487a5bf8", "created": 1712172329900, "from": "oc2-orch2-MacBook-Pro.local"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-03 15:25:31,162 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:25:31,162 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:25:31,162 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "78fe6366301d4726ac8224c6487a5bf8", "created": 1712172331160, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-03 15:28:06,758 - file - DEBUG - mqtt -- msg received ***
2024-04-03 15:28:06,759 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-03 15:28:06,759 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "f02b2bff770a495fa13190f69469802f", "created": 1712172485523, "from": "oc2-orch2-MacBook-Pro.local"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-03 15:28:06,775 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-03 15:28:06,776 - kestrel.config - DEBUG - Loading default config file...
2024-04-03 15:28:06,800 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-03 15:28:06,800 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-03 15:28:06,800 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-03 15:28:06,801 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-237c081a-004f-412f-88e9-1ea5d6159103.
2024-04-03 15:28:07,676 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:28:09,427 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:28:09,427 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-03 15:28:09,456 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-03 15:28:09,456 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:28:10,558 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-03 15:28:10,810 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-04T19:28:07.626Z' STOP t'2024-04-03T19:28:07.626Z'
2024-04-03 15:28:10,864 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:28:12,635 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:28:12,636 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-03 15:28:12,665 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-03 15:28:12,665 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:28:13,673 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-03 15:28:13,919 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-04T19:28:07.627Z' STOP t'2024-04-03T19:28:07.627Z'
2024-04-03 15:28:14,017 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-03 15:28:15,848 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:15,850 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:16,055 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:16,056 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:16,322 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:16,323 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:16,640 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:16,641 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:16,833 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:16,833 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:17,004 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:17,004 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:17,199 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:17,199 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:17,518 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:17,519 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:17,800 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:17,801 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:18,084 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:18,085 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:18,249 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:18,250 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-03 15:28:18,304 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:18,304 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-03 15:28:18,345 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-03 15:28:18,346 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-03 15:28:58,114 - file - DEBUG - mqtt -- publishing msg ***
2024-04-03 15:28:58,114 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-03 15:28:58,114 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "f02b2bff770a495fa13190f69469802f", "created": 1712172538108, "from": "oif-device-priapus-1712170284143"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-04 10:22:49,892 - file - DEBUG - Debug FILE -- App Started
2024-04-04 10:22:50,460 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-04 11:27:21,308 - file - DEBUG - mqtt -- msg received ***
2024-04-04 11:27:21,311 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 11:27:21,311 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b22e48fce9e540e685e3b5fe92f62439", "created": 1712244440140, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 11:27:21,409 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 11:27:21,409 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 11:27:21,409 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b22e48fce9e540e685e3b5fe92f62439", "created": 1712244441403, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 11:42:48,042 - file - DEBUG - mqtt -- msg received ***
2024-04-04 11:42:48,042 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 11:42:48,042 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "61e04a01c2ea4582b2c8f9991c609d75", "created": 1712245366439, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 11:42:48,076 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 11:42:48,077 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 11:42:48,077 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "61e04a01c2ea4582b2c8f9991c609d75", "created": 1712245368073, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 11:44:26,111 - file - DEBUG - mqtt -- msg received ***
2024-04-04 11:44:26,111 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 11:44:26,111 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "09a01d42a98e4ed697c65b3b8dcd44a0", "created": 1712245464861, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 11:44:26,160 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 11:44:26,160 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 11:44:26,161 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "09a01d42a98e4ed697c65b3b8dcd44a0", "created": 1712245466155, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:04:37,300 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:04:37,305 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:04:37,305 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "bd072621313b4dd2879bfd4de287afcc", "created": 1712246676174, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:04:37,382 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:04:37,382 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:04:37,382 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "bd072621313b4dd2879bfd4de287afcc", "created": 1712246677380, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:05:40,083 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:05:40,083 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:05:40,083 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "02de2dca32b249a4b4a289c0883af8d8", "created": 1712246738846, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:05:40,110 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:05:40,110 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:05:40,110 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "02de2dca32b249a4b4a289c0883af8d8", "created": 1712246740108, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:10:30,569 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:10:30,570 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:10:30,570 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "3f49448c5f18447d92a098c99f854b1f", "created": 1712247029276, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:10:30,608 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:10:30,608 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:10:30,608 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "3f49448c5f18447d92a098c99f854b1f", "created": 1712247030605, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:13:22,913 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:13:22,913 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:13:22,913 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a570f680803643ce9ed870c647441a18", "created": 1712247201789, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:13:22,948 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:13:22,948 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:13:22,948 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a570f680803643ce9ed870c647441a18", "created": 1712247202946, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:14:19,221 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:14:19,221 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:14:19,221 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "0ef8114ba34c432da4cfceac598a30fe", "created": 1712247258017, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:14:19,247 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:14:19,248 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:14:19,248 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "0ef8114ba34c432da4cfceac598a30fe", "created": 1712247259245, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:18:22,506 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:18:22,506 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:18:22,507 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a5949a95633a4c53bf00bc3cd23e5c59", "created": 1712247501373, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:18:22,532 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:18:22,532 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:18:22,532 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a5949a95633a4c53bf00bc3cd23e5c59", "created": 1712247502530, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:19:50,766 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:19:50,766 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:19:50,766 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "35b4c6efb1214a8289bcae9ca6115564", "created": 1712247589641, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:19:50,794 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:19:50,794 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:19:50,794 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "35b4c6efb1214a8289bcae9ca6115564", "created": 1712247590792, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:20:19,069 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:20:19,069 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:20:19,069 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "ea85ec3c44064c599fa66e338f1eb452", "created": 1712247617943, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:20:19,109 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:20:19,110 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:20:19,111 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "ea85ec3c44064c599fa66e338f1eb452", "created": 1712247619104, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 12:20:30,626 - file - DEBUG - mqtt -- msg received ***
2024-04-04 12:20:30,627 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 12:20:30,627 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "5101923288db4c98957f78321d1f6570", "created": 1712247629428, "from": "oc2-orch2-priapus"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 12:20:30,657 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 12:20:30,657 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 12:20:30,658 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "5101923288db4c98957f78321d1f6570", "created": 1712247630656, "from": "oif-device-priapus-1712240569872"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 14:03:16,444 - file - DEBUG - Debug FILE -- App Started
2024-04-04 14:03:16,976 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-04 14:04:21,926 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:04:21,926 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:04:21,926 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "f422c7d1511b4e539b30b6d541a8cf25", "created": 1712253858626, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 14:04:21,954 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:04:21,954 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:04:21,954 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "f422c7d1511b4e539b30b6d541a8cf25", "created": 1712253861950, "from": "oif-device-priapus-1712253796415"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 14:11:19,101 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:11:19,101 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:11:19,101 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "4c73e178f80b4bcdb9f6e50768263fb0", "created": 1712254275791, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 14:11:19,129 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:11:19,129 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:11:19,129 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "4c73e178f80b4bcdb9f6e50768263fb0", "created": 1712254279126, "from": "oif-device-priapus-1712253796415"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 14:12:44,652 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:12:44,652 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:12:44,652 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "1fc1c6e39b064a6596311db1186281d9", "created": 1712254361418, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-04 14:12:44,682 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-04 14:12:44,683 - kestrel.config - DEBUG - Loading default config file...
2024-04-04 14:12:44,720 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-04 14:12:44,720 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-04 14:12:44,721 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-04 14:12:44,722 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-8dbfb9cd-1e76-4f89-a80e-7f99b478ad76.
2024-04-04 14:12:47,871 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:12:50,793 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:12:50,795 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-04 14:12:50,932 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:12:50,934 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:12:52,960 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-04 14:12:53,512 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-05T18:12:47.414Z' STOP t'2024-04-04T18:12:47.414Z'
2024-04-04 14:12:53,580 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:12:55,484 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:12:55,484 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-04 14:12:55,579 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:12:55,584 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:12:56,877 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-04 14:12:57,523 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-05T18:12:47.437Z' STOP t'2024-04-04T18:12:47.437Z'
2024-04-04 14:12:57,622 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:13:00,328 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:00,330 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:00,947 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:00,949 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:01,423 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:01,425 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:01,863 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:01,864 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:02,290 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:02,298 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:02,816 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:02,818 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:03,273 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:03,275 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:03,730 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:03,732 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:04,226 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:04,228 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:04,854 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:04,856 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:05,226 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:05,228 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:13:05,332 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:05,332 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-04 14:13:05,457 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:13:05,458 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:14:05,108 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:14:05,109 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:14:05,109 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "1fc1c6e39b064a6596311db1186281d9", "created": 1712254445101, "from": "oif-device-priapus-1712253796415"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-04 14:48:19,796 - file - DEBUG - Debug FILE -- App Started
2024-04-04 14:48:20,324 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-04 14:48:36,235 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:48:36,236 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:48:36,236 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "39992875d19a4556ac91984032310436", "created": 1712256513062, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-04 14:48:36,273 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-04 14:48:36,274 - kestrel.config - DEBUG - Loading default config file...
2024-04-04 14:48:36,301 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-04 14:48:36,301 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-04 14:48:36,302 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-04 14:48:36,303 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-87521482-7cbc-4604-abe2-f24731b20c58.
2024-04-04 14:48:37,853 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:48:39,726 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:48:39,726 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-04 14:48:39,768 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:48:39,768 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:48:41,610 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-04 14:48:41,948 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-05T18:48:37.675Z' STOP t'2024-04-04T18:48:37.675Z'
2024-04-04 14:48:41,993 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:48:43,742 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:48:43,742 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-04 14:48:43,772 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:48:43,773 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:48:44,381 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-04 14:48:44,645 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-05T18:48:37.684Z' STOP t'2024-04-04T18:48:37.684Z'
2024-04-04 14:48:44,690 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:48:46,606 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:46,607 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:46,900 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:46,901 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:47,141 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:47,142 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:47,383 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:47,384 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:47,579 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:47,580 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:47,823 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:47,824 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:48,014 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:48,015 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:48,206 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:48,207 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:48,418 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:48,418 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:48,768 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:48,769 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:48,958 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:48,960 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:48:49,010 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:49,011 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-04 14:48:49,057 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:48:49,058 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:49:30,153 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:49:30,153 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:49:30,153 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "39992875d19a4556ac91984032310436", "created": 1712256570146, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-04 14:50:35,930 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:50:35,930 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:50:35,930 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "39030e2a92174b99a3b07356454b2568", "created": 1712256632764, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-04 14:50:35,947 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-04 14:50:35,948 - kestrel.config - DEBUG - Loading default config file...
2024-04-04 14:50:35,971 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-04 14:50:35,971 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-04 14:50:35,972 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-04 14:50:35,974 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-1b7a704a-c8ef-431b-a501-a2cf73fd10db.
2024-04-04 14:50:36,823 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:50:38,645 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:50:38,645 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-04 14:50:38,702 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-04 14:50:38,713 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:50:39,780 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-04 14:50:40,105 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-05T18:50:36.773Z' STOP t'2024-04-04T18:50:36.773Z'
2024-04-04 14:50:40,145 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:50:41,896 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:50:41,896 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-04 14:50:41,927 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-04 14:50:41,927 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:50:43,494 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-04 14:50:43,794 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-05T18:50:36.774Z' STOP t'2024-04-04T18:50:36.774Z'
2024-04-04 14:50:43,838 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-04 14:50:45,746 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:45,748 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:46,046 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:46,047 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:46,244 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:46,246 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:46,467 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:46,468 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:46,736 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:46,737 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:47,021 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:47,023 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:47,286 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:47,287 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:47,578 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:47,579 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:47,812 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:47,814 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:48,063 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:48,064 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:48,334 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:48,335 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-04 14:50:48,383 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:48,383 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 122
2024-04-04 14:50:48,415 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-04 14:50:48,416 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-04 14:51:28,720 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:51:28,720 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:51:28,720 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "39030e2a92174b99a3b07356454b2568", "created": 1712256688713, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-04 14:54:11,869 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:54:11,869 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:54:11,869 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "98e8a362640b43e2957f2ad6f21cd8d3", "created": 1712256848706, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": "datasources"}}}}}
2024-04-04 14:54:11,882 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:54:11,882 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:54:11,882 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "98e8a362640b43e2957f2ad6f21cd8d3", "created": 1712256851881, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": "query action completed by OIF Device"}}}}
2024-04-04 14:55:46,158 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:55:46,158 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:55:46,159 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "1de8234dda3645b89d9ec7ec13ce7a28", "created": 1712256942982, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 14:55:46,193 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:55:46,193 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:55:46,193 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "1de8234dda3645b89d9ec7ec13ce7a28", "created": 1712256946191, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 14:56:47,927 - file - DEBUG - mqtt -- msg received ***
2024-04-04 14:56:47,927 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 14:56:47,927 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "caf365209bdf485cbd76c4cd3a42facd", "created": 1712257004770, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 14:56:47,955 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 14:56:47,955 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 14:56:47,956 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "caf365209bdf485cbd76c4cd3a42facd", "created": 1712257007954, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 15:48:23,460 - file - DEBUG - mqtt -- msg received ***
2024-04-04 15:48:23,460 - file - DEBUG - mqtt -- topic: oc2/cmd/test
2024-04-04 15:48:23,461 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "b6f12ab0f2b84f45a4020f1d4de61a35", "created": 1712260100301, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-04 15:48:23,502 - file - DEBUG - mqtt -- publishing msg ***
2024-04-04 15:48:23,502 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-04 15:48:23,502 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "b6f12ab0f2b84f45a4020f1d4de61a35", "created": 1712260103496, "from": "oif-device-priapus-1712256499769"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-04 16:29:21,378 - file - DEBUG - Debug FILE -- App Started
2024-04-04 16:29:21,907 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-05 09:40:49,555 - file - DEBUG - Debug FILE -- App Started
2024-04-05 09:40:53,184 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-05 11:20:24,458 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:20:24,463 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:20:24,463 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "ee03bd8d-61d2-4340-a5ba-e5d8448afb85", "from": "mqtt_tester_2e131d76-65e0-4fd9-ab21-a30a7223791d", "to": "test_receiver", "created": 1712330423701, "actuator_id": "8144acd3-f5d6-4bda-b1bd-a964f4a19677"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-4.jhf"}}, "args": {"th": {"huntargs": {"string_args": ["filename_1:siblings.json", "filename_2:hosts.json"]}}}}}}}
2024-04-05 11:20:24,488 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-05 11:20:24,489 - kestrel.config - DEBUG - Loading default config file...
2024-04-05 11:20:24,510 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-05 11:20:24,510 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-05 11:20:24,510 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-05 11:20:24,511 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-f7be2a7c-ee79-4f2d-969b-032b47507bfd.
2024-04-05 11:20:26,221 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:20:28,040 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 20, 'relation': 'eq'}
2024-04-05 11:20:28,041 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 20
2024-04-05 11:20:28,073 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 20, 'relation': 'eq'}
2024-04-05 11:20:28,073 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:20:29,250 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-05 11:20:29,263 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch nt_local.
2024-04-05 11:20:29,263 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-05 11:20:29,324 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:20:30,972 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 37, 'relation': 'eq'}
2024-04-05 11:20:30,972 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 37
2024-04-05 11:20:30,998 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 37, 'relation': 'eq'}
2024-04-05 11:20:30,998 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:20:32,204 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch nt_fw_local.
2024-04-05 11:20:32,204 - kestrel.codegen.prefetch - INFO - prefetch does not happen without STIX pattern generated.
2024-04-05 11:20:32,212 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch remoteip_local.
2024-04-05 11:20:32,445 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [ipv4-addr:value IN ('172.16.1.13','172.16.1.14')] START t'2024-03-06T16:04:53.000Z' STOP t'2024-03-06T19:02:34.839Z'
2024-04-05 11:20:32,483 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:20:34,131 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 121, 'relation': 'eq'}
2024-04-05 11:20:34,131 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 121
2024-04-05 11:20:34,160 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 121, 'relation': 'eq'}
2024-04-05 11:20:34,160 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:20:35,613 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:20:35,614 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:20:35,614 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "ee03bd8d-61d2-4340-a5ba-e5d8448afb85", "created": 1712330435612, "from": "oif-device-priapus-1712324449534"}, "body": {"openc2": {"response": {"status": 200, "results": {"remoteip": {"value": "172.16.1.14", "id": "ipv4-addr--63150511-f347-50d6-bb0d-e7d9ac7bd017", "type": "ipv4-addr"}}}}}}
2024-04-05 11:20:52,634 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:20:52,634 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:20:52,634 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "7305b098-e10e-41b1-9e55-14dbc89c9802", "from": "mqtt_tester_c0ed3710-9907-4961-b33c-eb5f492f4e4d", "to": "test_receiver", "created": 1712330451647, "actuator_id": "8144acd3-f5d6-4bda-b1bd-a964f4a19677"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 11:20:52,734 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:20:52,734 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:20:52,734 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "7305b098-e10e-41b1-9e55-14dbc89c9802", "created": 1712330452732, "from": "oif-device-priapus-1712324449534"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 11:26:41,938 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:26:41,938 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:26:41,938 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "2208e4d6c4d24daa9632e5fc9ee2a617", "created": 1712330797444, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 11:26:41,977 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:26:41,978 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:26:41,978 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "2208e4d6c4d24daa9632e5fc9ee2a617", "created": 1712330801975, "from": "oif-device-priapus-1712324449534"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 11:28:51,755 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:28:51,755 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:28:51,756 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "26e92146e88541e5b4d1b13930d9f721", "created": 1712330927223, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 11:28:51,785 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:28:51,786 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:28:51,786 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "26e92146e88541e5b4d1b13930d9f721", "created": 1712330931780, "from": "oif-device-priapus-1712324449534"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 11:29:48,183 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:29:48,184 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:29:48,184 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a870f8af43f84230b012eb49b7ca680f", "created": 1712330983593, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-05 11:29:48,202 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-05 11:29:48,203 - kestrel.config - DEBUG - Loading default config file...
2024-04-05 11:29:48,225 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-05 11:29:48,225 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-05 11:29:48,226 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-05 11:29:48,227 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-15435d80-9eeb-42d8-8de1-1ce1fa49591f.
2024-04-05 11:29:48,983 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:29:51,008 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 11:29:51,008 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-05 11:29:51,051 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 11:29:51,051 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:29:52,817 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-05 11:29:53,091 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-06T15:29:48.930Z' STOP t'2024-04-05T15:29:48.930Z'
2024-04-05 11:29:53,135 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:29:54,825 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 11:29:54,825 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-05 11:29:54,861 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 11:29:54,862 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:29:56,221 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-05 11:29:56,456 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-06T15:29:48.931Z' STOP t'2024-04-05T15:29:48.931Z'
2024-04-05 11:29:56,494 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 11:29:58,302 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:58,303 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:58,595 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:58,596 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:58,836 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:58,838 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:59,057 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:59,058 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:59,229 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:59,230 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:59,454 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:59,455 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:59,624 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:59,625 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:29:59,810 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:29:59,811 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:30:00,003 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:30:00,004 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 11:30:00,078 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:30:00,079 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 470
2024-04-05 11:30:00,133 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 11:30:00,134 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 11:30:30,040 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:30:30,040 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:30:30,040 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a870f8af43f84230b012eb49b7ca680f", "created": 1712331030034, "from": "oif-device-priapus-1712324449534"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": "C:\\Users\\Administrator\\Documents\\", "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-05 11:35:20,899 - file - DEBUG - Debug FILE -- App Started
2024-04-05 11:35:21,440 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-05 11:43:57,804 - file - DEBUG - mqtt -- msg received ***
2024-04-05 11:43:57,804 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 11:43:57,804 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "e4343a0831c94e9888e17afd438152b2", "created": 1712331833280, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 11:43:57,830 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 11:43:57,830 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 11:43:57,830 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "e4343a0831c94e9888e17afd438152b2", "created": 1712331837828, "from": "oif-device-priapus-1712331320880"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 12:37:05,257 - file - DEBUG - mqtt -- msg received ***
2024-04-05 12:37:05,257 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 12:37:05,257 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "cf56a54c14624d3c9bce47495536b12e", "created": 1712335020765, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 12:37:05,282 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 12:37:05,282 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 12:37:05,282 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "cf56a54c14624d3c9bce47495536b12e", "created": 1712335025279, "from": "oif-device-priapus-1712331320880"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 12:37:17,632 - file - DEBUG - mqtt -- msg received ***
2024-04-05 12:37:17,632 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 12:37:17,632 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "79493e74d4b8437984895167c37fed19", "created": 1712335033117, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "query", "target": {"th": {"huntflows": {"path": "./"}}}}}}}
2024-04-05 12:37:17,654 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 12:37:17,654 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 12:37:17,655 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "79493e74d4b8437984895167c37fed19", "created": 1712335037652, "from": "oif-device-priapus-1712331320880"}, "body": {"openc2": {"response": {"status": 200, "results": [{"filename": "oc2-hunt-3.jhf", "fullpath": "./hunts/jinja/oc2-hunt-3.jhf"}, {"filename": "oc2-hunt-1.jhf", "fullpath": "./hunts/jinja/oc2-hunt-1.jhf"}, {"filename": "oc2-hunt-4.jhf", "fullpath": "./hunts/jinja/oc2-hunt-4.jhf"}, {"filename": "oc2-hunt-2.jhf", "fullpath": "./hunts/jinja/oc2-hunt-2.jhf"}]}}}}
2024-04-05 12:38:34,842 - file - DEBUG - mqtt -- msg received ***
2024-04-05 12:38:34,843 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 12:38:34,843 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "a368b08136cd4e05bf5bcfb702f5b05d", "created": 1712335110280, "from": "oc2-orch2-MacBook-Pro"}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-05 12:38:34,863 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-05 12:38:34,864 - kestrel.config - DEBUG - Loading default config file...
2024-04-05 12:38:34,884 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-05 12:38:34,884 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-05 12:38:34,884 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-05 12:38:34,885 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-b94a3b20-482c-4100-b5f9-a676e8b6b72b.
2024-04-05 12:38:36,115 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 12:38:37,922 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 12:38:37,922 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-05 12:38:37,956 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 12:38:37,956 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 12:38:39,093 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-05 12:38:39,365 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-06T16:38:35.959Z' STOP t'2024-04-05T16:38:35.959Z'
2024-04-05 12:38:39,408 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 12:38:41,075 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 12:38:41,075 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-05 12:38:41,102 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 12:38:41,103 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 12:38:42,469 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-05 12:38:42,699 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-06T16:38:35.967Z' STOP t'2024-04-05T16:38:35.967Z'
2024-04-05 12:38:42,737 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 12:38:44,516 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:44,517 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:44,817 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:44,818 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:45,064 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:45,065 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:45,258 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:45,259 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:45,490 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:45,491 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:45,742 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:45,743 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:45,907 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:45,908 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 12:38:46,024 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:46,024 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 846
2024-04-05 12:38:46,059 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 12:38:46,060 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 12:39:08,728 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 12:39:08,728 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 12:39:08,728 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "a368b08136cd4e05bf5bcfb702f5b05d", "created": 1712335148722, "from": "oif-device-priapus-1712331320880"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.x_path": null, "binary_ref.x_extension": null, "binary_ref.x_target_path": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": null, "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.x_path": null, "parent_ref.binary_ref.x_extension": null, "parent_ref.binary_ref.x_target_path": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-05 13:34:59,738 - file - DEBUG - Debug FILE -- App Started
2024-04-05 13:35:00,532 - asyncio - DEBUG - Using selector: EpollSelector
2024-04-05 13:36:26,020 - file - DEBUG - mqtt -- msg received ***
2024-04-05 13:36:26,020 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt
2024-04-05 13:36:26,021 - file - DEBUG - mqtt -- msg: {"headers": {"request_id": "3e566b64-753d-4ac9-a2c9-90b2d552a750", "from": "mqtt_tester-priapus-1712338585179", "to": "test_receiver", "created": 1712338585180}, "body": {"openc2": {"request": {"action": "investigate", "target": {"th": {"hunt": "./hunts/jinja/oc2-hunt-1.jhf"}}}}}}
2024-04-05 13:36:26,047 - kestrel.session - DEBUG - Establish session with session_id: None, runtime_dir: None, store_path:None, debug_mode:False
2024-04-05 13:36:26,048 - kestrel.config - DEBUG - Loading default config file...
2024-04-05 13:36:26,067 - kestrel.config - DEBUG - User configuration file not exist.
2024-04-05 13:36:26,067 - kestrel.config - DEBUG - User configuration loaded: {}
2024-04-05 13:36:26,067 - kestrel.config - DEBUG - Updating default config with user config...
2024-04-05 13:36:26,069 - kestrel.session - DEBUG - create new session runtime_directory: /tmp/kestrel-session-1001-256941b1-f530-4c30-9100-2928880ab50f.
2024-04-05 13:36:27,427 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 13:36:29,261 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 13:36:29,261 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 1
2024-04-05 13:36:29,294 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 1, 'relation': 'eq'}
2024-04-05 13:36:29,294 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 13:36:30,291 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch disablefw_local.
2024-04-05 13:36:30,567 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [process:x_unique_id = '{dd94cc1a-bd78-65e8-9610-000000000500}'] START t'2024-03-06T17:36:27.265Z' STOP t'2024-04-05T17:36:27.265Z'
2024-04-05 13:36:30,604 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 13:36:32,334 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 13:36:32,335 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2
2024-04-05 13:36:32,359 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 2, 'relation': 'eq'}
2024-04-05 13:36:32,359 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 13:36:32,919 - kestrel.codegen.prefetch - INFO - generate pattern for prefetch hosts_local.
2024-04-05 13:36:33,154 - kestrel.codegen.prefetch - INFO - STIX pattern generated in prefetch: [x-oca-asset:device_id = 'dd94cc1a-b670-4c10-82f3-65fd39929711'] START t'2024-03-06T17:36:27.273Z' STOP t'2024-04-05T17:36:27.273Z'
2024-04-05 13:36:33,192 - stix_shifter_modules.elastic_ecs.stix_translation.query_translator - INFO - Converting STIX2 Pattern to data source query
2024-04-05 13:36:34,958 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:34,959 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 13:36:35,201 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,202 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 13:36:35,382 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,383 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 13:36:35,556 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,558 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 13:36:35,730 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,731 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 2000
2024-04-05 13:36:35,880 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,880 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 809
2024-04-05 13:36:35,916 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of hits:{'value': 10000, 'relation': 'gte'}
2024-04-05 13:36:35,916 - stix_shifter_modules.elastic_ecs.stix_transmission.connector - ERROR - Total # of records: 0
2024-04-05 13:36:53,402 - file - DEBUG - mqtt -- publishing msg ***
2024-04-05 13:36:53,402 - file - DEBUG - mqtt -- topic: oc2/rsp
2024-04-05 13:36:53,402 - file - DEBUG - mqtt -- rsp msg: {"headers": {"request_id": "3e566b64-753d-4ac9-a2c9-90b2d552a750", "created": 1712338613396, "from": "oif-device-priapus-1712338499720"}, "body": {"openc2": {"response": {"status": 200, "results": {"disablefw": {"name": "netsh.exe", "pid": 12232, "x_unique_id": "{dd94cc1a-bd78-65e8-9610-000000000500}", "command_line": "netsh advfirewall set allprofiles state off", "id": "process--7dccc952-6663-579d-ba34-5a8a489de95d", "cwd": "C:\\WINDOWS\\system32\\", "x_window_title": null, "binary_ref.name": "netsh.exe", "binary_ref.id": "file--b79adcff-5054-5b1f-96af-500475b71f21", "binary_ref.hashes.'SHA-256'": null, "binary_ref.hashes.MD5": null, "binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.name": "cmd.exe", "parent_ref.pid": 5268, "parent_ref.x_unique_id": "{dd94cc1a-bd59-65e8-9410-000000000500}", "parent_ref.command_line": "cmd.exe", "parent_ref.id": "process--4527beab-7e6d-5587-bb74-94554996724d", "parent_ref.cwd": "C:\\WINDOWS\\system32\\", "parent_ref.x_window_title": null, "parent_ref.parent_ref.name": "badidea.exe", "parent_ref.parent_ref.pid": 3096, "parent_ref.parent_ref.x_unique_id": "{dd94cc1a-9565-65e8-4b0f-000000000500}", "parent_ref.parent_ref.command_line": "\"C:\\Users\\Public\\badidea.exe\" ", "parent_ref.parent_ref.id": "process--f42543ad-54ba-5878-a0b7-2800f019934b", "parent_ref.parent_ref.cwd": null, "parent_ref.parent_ref.x_window_title": null, "parent_ref.binary_ref.name": "cmd.exe", "parent_ref.binary_ref.id": "file--bdb40b46-65f7-5a74-9516-60746576d4e7", "parent_ref.binary_ref.hashes.'SHA-256'": null, "parent_ref.binary_ref.hashes.MD5": null, "parent_ref.binary_ref.parent_directory_ref.path": "C:\\Windows\\System32", "parent_ref.binary_ref.parent_directory_ref.id": "directory--0a58d0c1-59e6-5afd-8252-dcd3f13e5622", "parent_ref.creator_user_ref.x_domain": "NT AUTHORITY", "parent_ref.creator_user_ref.user_id": "SYSTEM", "parent_ref.creator_user_ref.account_login": "SYSTEM", "parent_ref.creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "creator_user_ref.x_domain": "NT AUTHORITY", "creator_user_ref.user_id": "SYSTEM", "creator_user_ref.account_login": "SYSTEM", "creator_user_ref.id": "user-account--2d7bb9a7-98f3-5d8e-b6e0-9a10ef930561", "type": "process"}, "hosts": {"hostname": "win10-casp-ws2", "name": "win10-casp-ws2", "device_id": "dd94cc1a-b670-4c10-82f3-65fd39929711", "architecture": "x86_64", "id": "x-oca-asset--254a9cca-587a-56fc-8f3e-6d62d4979eab", "type": "x-oca-asset"}}}}}}
2024-04-05 13:40:10,497 - file - DEBUG - mqtt -- msg received ***
2024-04-05 13:40:10,497 - file - DEBUG - mqtt -- topic: oc2/cmd/ap/hunt