['flow', 'tls']
src_ip: 172.16.0.1, src_port: 45022, dest_ip: 192.168.10.51, dest_port: 444, event_type: flow, proto: TCP, app_proto: tls, flow_pkts_toserver: 28412, flow_pkts_toclient: 20884, flow_bytes_toserver: 1963593, flow_bytes_toclient: 81482031, flow_age: 1228, flow_state: closed, flow_reason: timeout, metadata_flowbits_0: ET.HB.Response.CI, metadata_flowbits_1: ET.HB.Response.SI, tcp_tcp_flags: 1f, tcp_tcp_flags_ts: 1f, tcp_tcp_flags_tc: 1a, tcp_syn: True, tcp_fin: True, tcp_rst: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 12483405, event_type: tls, proto: TCP, tls_subject: C=CA, ST=NB, L=f, O=Internet Widgits Pty Ltd, tls_issuerdn: C=CA, ST=NB, L=f, O=Internet Widgits Pty Ltd, tls_serial: 00:89:82:87:F6:84:5C:C0:08, tls_fingerprint: bf:0f:8b:c6:4e:77:9e:6e:0f:f4:7b:9b:f5:57:46:e9:6e:f5:0f:15, tls_version: TLS 1.2, tls_notbefore: 2016-05-31T14:28:15, tls_notafter: 2017-05-31T14:28:15
The network event indicates a Heartbleed attack. Heartbleed attacks exploit the Heartbleed vulnerability in the OpenSSL library, allowing attackers to read sensitive data from the server's memory. Typically, the logs show traffic patterns indicative of exploitation attempts to extract data from the server. The logs often indicate the presence of metadata flow bits such as ET.HB.Response.CI and ET.HB.Response.SI, consistent with Heartbleed response patterns. The large volume of data transferred to the client compared to the data sent to the server is a strong indicator of data extraction attempts.
classification: Attack
justification: The network event indicates a Heartbleed attack. Heartbleed attacks exploit the Heartbleed vulnerability in the OpenSSL library, allowing attackers to read sensitive data from the server's memory. Typically, the logs show traffic patterns indicative of exploitation attempts to extract data from the server. The logs often indicate the presence of metadata flow bits such as ET.HB.Response.CI and ET.HB.Response.SI, consistent with Heartbleed response patterns. The large volume of data transferred to the client compared to the data sent to the server is a strong indicator of data extraction attempts.