الملفات
ghaymah-exam-Mohamed-Ashraf…/q4-SIEM-build/dashboard/logs/endpoint2_firewall.log

35 أسطر
3.0 KiB
Plaintext

2026-07-27 09:57:40 SRC=10.0.0.12 SPT=51422 DST=10.0.0.1 DPT=53 PROTO=UDP ACTION=ALLOW
2026-07-27 09:58:02 SRC=10.0.0.14 SPT=51500 DST=198.51.100.200 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 09:58:30 SRC=10.0.0.12 SPT=51410 DST=10.0.0.1 DPT=123 PROTO=UDP ACTION=ALLOW
2026-07-27 09:59:10 SRC=198.51.100.10 SPT=51022 DST=10.0.0.5 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 09:59:44 SRC=198.51.100.11 SPT=51023 DST=10.0.0.5 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 10:00:12 SRC=198.51.100.23 SPT=51099 DST=10.0.0.5 DPT=80 PROTO=TCP ACTION=ALLOW
2026-07-27 10:02:40 SRC=203.0.113.66 SPT=44012 DST=10.0.0.5 DPT=3306 PROTO=TCP ACTION=DENY
2026-07-27 10:02:41 SRC=203.0.113.66 SPT=44013 DST=10.0.0.5 DPT=3306 PROTO=TCP ACTION=DENY
2026-07-27 10:02:55 SRC=203.0.113.66 SPT=44020 DST=10.0.0.5 DPT=5432 PROTO=TCP ACTION=DENY
2026-07-27 10:04:00 SRC=10.0.0.14 SPT=51600 DST=198.51.100.201 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33001 DST=10.0.0.5 DPT=20 PROTO=TCP ACTION=DENY
2026-07-27 10:05:01 SRC=192.0.2.77 SPT=33002 DST=10.0.0.5 DPT=21 PROTO=TCP ACTION=DENY
2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33003 DST=10.0.0.5 DPT=22 PROTO=TCP ACTION=ALLOW
2026-07-27 10:05:02 SRC=192.0.2.77 SPT=33004 DST=10.0.0.5 DPT=23 PROTO=TCP ACTION=DENY
2026-07-27 10:05:03 SRC=192.0.2.77 SPT=33005 DST=10.0.0.5 DPT=25 PROTO=TCP ACTION=DENY
2026-07-27 10:05:03 SRC=192.0.2.77 SPT=33006 DST=10.0.0.5 DPT=53 PROTO=TCP ACTION=DENY
2026-07-27 10:05:04 SRC=192.0.2.77 SPT=33007 DST=10.0.0.5 DPT=80 PROTO=TCP ACTION=ALLOW
2026-07-27 10:05:04 SRC=192.0.2.77 SPT=33008 DST=10.0.0.5 DPT=110 PROTO=TCP ACTION=DENY
2026-07-27 10:05:05 SRC=192.0.2.77 SPT=33009 DST=10.0.0.5 DPT=139 PROTO=TCP ACTION=DENY
2026-07-27 10:05:05 SRC=192.0.2.77 SPT=33010 DST=10.0.0.5 DPT=143 PROTO=TCP ACTION=DENY
2026-07-27 10:05:06 SRC=192.0.2.77 SPT=33011 DST=10.0.0.5 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 10:05:06 SRC=192.0.2.77 SPT=33012 DST=10.0.0.5 DPT=445 PROTO=TCP ACTION=DENY
2026-07-27 10:05:07 SRC=192.0.2.77 SPT=33013 DST=10.0.0.5 DPT=993 PROTO=TCP ACTION=DENY
2026-07-27 10:05:07 SRC=192.0.2.77 SPT=33014 DST=10.0.0.5 DPT=995 PROTO=TCP ACTION=DENY
2026-07-27 10:05:08 SRC=192.0.2.77 SPT=33015 DST=10.0.0.5 DPT=1433 PROTO=TCP ACTION=DENY
2026-07-27 10:05:08 SRC=192.0.2.77 SPT=33016 DST=10.0.0.5 DPT=3306 PROTO=TCP ACTION=DENY
2026-07-27 10:05:09 SRC=192.0.2.77 SPT=33017 DST=10.0.0.5 DPT=3389 PROTO=TCP ACTION=DENY
2026-07-27 10:05:09 SRC=192.0.2.77 SPT=33018 DST=10.0.0.5 DPT=5432 PROTO=TCP ACTION=DENY
2026-07-27 10:05:10 SRC=192.0.2.77 SPT=33019 DST=10.0.0.5 DPT=8080 PROTO=TCP ACTION=DENY
2026-07-27 10:05:10 SRC=192.0.2.77 SPT=33020 DST=10.0.0.5 DPT=8443 PROTO=TCP ACTION=DENY
2026-07-27 10:06:20 SRC=10.0.0.12 SPT=51701 DST=10.0.0.1 DPT=53 PROTO=UDP ACTION=ALLOW
2026-07-27 10:07:15 SRC=198.51.100.45 SPT=51201 DST=10.0.0.5 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 10:08:00 SRC=10.0.0.14 SPT=51820 DST=198.51.100.202 DPT=443 PROTO=TCP ACTION=ALLOW
2026-07-27 10:09:12 SRC=198.51.100.10 SPT=51340 DST=10.0.0.5 DPT=443 PROTO=TCP ACTION=ALLOW