Paste

Uploaded March 9 at 11:16 am by Ewald XYZ 
PRAGMA foreign_keys=OFF;
BEGIN TRANSACTION;
CREATE TABLE alerts (
				id INTEGER PRIMARY KEY,

				-- Store the timestamp
				timestamp INTEGER NOT NULL,

				-- Store the entire JSON object
				event JSONB NOT NULL
			);
INSERT INTO alerts VALUES(1,1772967419.289304019,'{"timestamp": "2026-03-08T11:56:59.289304+0100", "flow_id": 961079698010690, "event_type": "alert", "src_ip": "147.185.132.124", "src_port": 52155, "dest_ip": "185.254.126.122", "dest_port": 47687, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T11:56:59.289304+0100", "src_ip": "147.185.132.124", "dest_ip": "185.254.126.122", "src_port": 52155, "dest_port": 47687}}');
INSERT INTO alerts VALUES(2,1772967430.522192002,'{"timestamp": "2026-03-08T11:57:10.522192+0100", "flow_id": 1961325238545215, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 45714, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 37714, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T11:57:10.522192+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 45714, "dest_port": 53}}');
INSERT INTO alerts VALUES(3,1772967434.425358058,'{"timestamp": "2026-03-08T11:57:14.425358+0100", "flow_id": 701000256440767, "event_type": "alert", "src_ip": "167.94.146.78", "src_port": 44851, "dest_ip": "185.254.126.122", "dest_port": 7327, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T11:57:14.425358+0100", "src_ip": "167.94.146.78", "dest_ip": "185.254.126.122", "src_port": 44851, "dest_port": 7327}}');
INSERT INTO alerts VALUES(4,1772967435.376257896,'{"timestamp": "2026-03-08T11:57:15.376258+0100", "flow_id": 1053068619941182, "event_type": "alert", "src_ip": "178.20.210.152", "src_port": 58665, "dest_ip": "185.254.126.122", "dest_port": 8022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T11:57:15.376258+0100", "src_ip": "178.20.210.152", "dest_ip": "185.254.126.122", "src_port": 58665, "dest_port": 8022}}');
INSERT INTO alerts VALUES(5,1772967445.550744057,'{"timestamp": "2026-03-08T11:57:25.550744+0100", "flow_id": 1449412654630148, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 52356, "dest_ip": "94.130.221.203", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053282, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "ts_progress": "client_hello_done", "tc_progress": "server_in_progress", "tls": {"sni": "relays.syncthing.net", "version": "TLS 1.3", "ja3": {"hash": "473cd7cb9faa642487833865d516e578", "string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0"}, "ja4": "t13d190900_9dc949149365_97f8aa674fd9"}, "app_proto": "tls", "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 1, "bytes_toserver": 432, "bytes_toclient": 60, "start": "2026-03-08T11:57:25.534075+0100", "src_ip": "192.168.2.16", "dest_ip": "94.130.221.203", "src_port": 52356, "dest_port": 443}}');
INSERT INTO alerts VALUES(6,1772967462.691016913,'{"timestamp": "2026-03-08T11:57:42.691017+0100", "flow_id": 1841996644906554, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 9443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T11:57:42.691017+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 9443}}');
INSERT INTO alerts VALUES(7,1772967505.315068006,'{"timestamp": "2026-03-08T11:58:25.315068+0100", "flow_id": 508782971207888, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 9090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T11:58:25.315068+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 9090}}');
INSERT INTO alerts VALUES(8,1772967505.315068006,'{"timestamp": "2026-03-08T11:58:25.315068+0100", "flow_id": 508782971207888, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 9090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T11:58:25.315068+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 9090}}');
INSERT INTO alerts VALUES(9,1772967513.185911893,'{"timestamp": "2026-03-08T11:58:33.185912+0100", "flow_id": 517012712376562, "event_type": "alert", "src_ip": "45.153.34.226", "src_port": 34891, "dest_ip": "185.254.126.122", "dest_port": 20087, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T11:58:33.185912+0100", "src_ip": "45.153.34.226", "dest_ip": "185.254.126.122", "src_port": 34891, "dest_port": 20087}}');
INSERT INTO alerts VALUES(10,1772967513.185911893,'{"timestamp": "2026-03-08T11:58:33.185912+0100", "flow_id": 517012712376562, "event_type": "alert", "src_ip": "45.153.34.226", "src_port": 34891, "dest_ip": "185.254.126.122", "dest_port": 20087, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500030, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T11:58:33.185912+0100", "src_ip": "45.153.34.226", "dest_ip": "185.254.126.122", "src_port": 34891, "dest_port": 20087}}');
INSERT INTO alerts VALUES(11,1772967517.290266037,'{"timestamp": "2026-03-08T11:58:37.290266+0100", "flow_id": 1528159260649158, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 11490, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T11:58:37.290266+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 11490}}');
INSERT INTO alerts VALUES(12,1772967628.863492013,'{"timestamp": "2026-03-08T12:00:28.863492+0100", "flow_id": 1175398258371088, "event_type": "alert", "src_ip": "45.153.34.226", "src_port": 40915, "dest_ip": "185.254.126.122", "dest_port": 40531, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500030, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:00:28.863492+0100", "src_ip": "45.153.34.226", "dest_ip": "185.254.126.122", "src_port": 40915, "dest_port": 40531}}');
INSERT INTO alerts VALUES(13,1772967716.599706888,'{"timestamp": "2026-03-08T12:01:56.599707+0100", "flow_id": 1168348496966980, "event_type": "alert", "src_ip": "64.89.163.131", "src_port": 47590, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:01:56.599707+0100", "src_ip": "64.89.163.131", "dest_ip": "185.254.126.122", "src_port": 47590, "dest_port": 27017}}');
INSERT INTO alerts VALUES(14,1772967719.755100011,'{"timestamp": "2026-03-08T12:01:59.755100+0100", "flow_id": 2117233669084283, "event_type": "alert", "src_ip": "204.76.203.30", "src_port": 56069, "dest_ip": "185.254.126.122", "dest_port": 3128, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:01:59.755100+0100", "src_ip": "204.76.203.30", "dest_ip": "185.254.126.122", "src_port": 56069, "dest_port": 3128}}');
INSERT INTO alerts VALUES(15,1772967719.755100011,'{"timestamp": "2026-03-08T12:01:59.755100+0100", "flow_id": 2117233669084283, "event_type": "alert", "src_ip": "204.76.203.30", "src_port": 56069, "dest_ip": "185.254.126.122", "dest_port": 3128, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:01:59.755100+0100", "src_ip": "204.76.203.30", "dest_ip": "185.254.126.122", "src_port": 56069, "dest_port": 3128}}');
INSERT INTO alerts VALUES(16,1772967724.022171021,'{"timestamp": "2026-03-08T12:02:04.022171+0100", "flow_id": 1221127573491045, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 43472, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:02:04.022171+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 43472, "dest_port": 3389}}');
INSERT INTO alerts VALUES(17,1772967727.100486993,'{"timestamp": "2026-03-08T12:02:07.100487+0100", "flow_id": 2120438464613340, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 40524, "dest_ip": "185.254.126.122", "dest_port": 2022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:02:07.100487+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 40524, "dest_port": 2022}}');
INSERT INTO alerts VALUES(18,1772967727.100486993,'{"timestamp": "2026-03-08T12:02:07.100487+0100", "flow_id": 2120438464613340, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 40524, "dest_ip": "185.254.126.122", "dest_port": 2022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:02:07.100487+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 40524, "dest_port": 2022}}');
INSERT INTO alerts VALUES(19,1772967761.398516894,'{"timestamp": "2026-03-08T12:02:41.398517+0100", "flow_id": 304243077302727, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 43068, "dest_ip": "185.254.126.122", "dest_port": 553, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:02:41.398517+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 43068, "dest_port": 553}}');
INSERT INTO alerts VALUES(20,1772967824.602550029,'{"timestamp": "2026-03-08T12:03:44.602550+0100", "flow_id": 54660028446774, "event_type": "alert", "src_ip": "87.121.84.57", "src_port": 51588, "dest_ip": "185.254.126.122", "dest_port": 4443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:03:44.602550+0100", "src_ip": "87.121.84.57", "dest_ip": "185.254.126.122", "src_port": 51588, "dest_port": 4443}}');
INSERT INTO alerts VALUES(21,1772967868.477924108,'{"timestamp": "2026-03-08T12:04:28.477924+0100", "flow_id": 1208244744334416, "event_type": "alert", "src_ip": "64.62.197.15", "src_port": 50066, "dest_ip": "185.254.126.122", "dest_port": 6081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:04:28.477924+0100", "src_ip": "64.62.197.15", "dest_ip": "185.254.126.122", "src_port": 50066, "dest_port": 6081}}');
INSERT INTO alerts VALUES(22,1772967888.195934057,'{"timestamp": "2026-03-08T12:04:48.195934+0100", "flow_id": 278581619090316, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 43615, "dest_ip": "185.254.126.122", "dest_port": 54373, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:04:48.195934+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 43615, "dest_port": 54373}}');
INSERT INTO alerts VALUES(23,1772967920.094182014,'{"timestamp": "2026-03-08T12:05:20.094182+0100", "flow_id": 123035360179307, "event_type": "alert", "src_ip": "176.65.134.20", "src_port": 35702, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:05:20.094182+0100", "src_ip": "176.65.134.20", "dest_ip": "185.254.126.122", "src_port": 35702, "dest_port": 443}}');
INSERT INTO alerts VALUES(24,1772967933.246010066,'{"timestamp": "2026-03-08T12:05:33.246010+0100", "flow_id": 1619556146710321, "event_type": "alert", "src_ip": "64.62.156.83", "src_port": 52572, "dest_ip": "185.254.126.122", "dest_port": 6081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:05:33.246010+0100", "src_ip": "64.62.156.83", "dest_ip": "185.254.126.122", "src_port": 52572, "dest_port": 6081}}');
INSERT INTO alerts VALUES(25,1772967936.600552083,'{"timestamp": "2026-03-08T12:05:36.600552+0100", "flow_id": 46076522523795, "event_type": "alert", "src_ip": "45.142.154.87", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 3110, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:05:36.600552+0100", "src_ip": "45.142.154.87", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 3110}}');
INSERT INTO alerts VALUES(26,1772968044.579890966,'{"timestamp": "2026-03-08T12:07:24.579891+0100", "flow_id": 1364715767711103, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 42263, "dest_ip": "185.254.126.122", "dest_port": 22022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:07:24.579891+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 42263, "dest_port": 22022}}');
INSERT INTO alerts VALUES(27,1772968044.579890966,'{"timestamp": "2026-03-08T12:07:24.579891+0100", "flow_id": 1364715767711103, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 42263, "dest_ip": "185.254.126.122", "dest_port": 22022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:07:24.579891+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 42263, "dest_port": 22022}}');
INSERT INTO alerts VALUES(28,1772968058.646970034,'{"timestamp": "2026-03-08T12:07:38.646970+0100", "flow_id": 808390271498471, "event_type": "alert", "src_ip": "167.94.138.128", "src_port": 50241, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:07:38.646970+0100", "src_ip": "167.94.138.128", "dest_ip": "185.254.126.122", "src_port": 50241, "dest_port": 80}}');
INSERT INTO alerts VALUES(29,1772968064.870910883,'{"timestamp": "2026-03-08T12:07:44.870911+0100", "flow_id": 81361713106344, "event_type": "alert", "src_ip": "64.62.156.126", "src_port": 43849, "dest_ip": "185.254.126.122", "dest_port": 9100, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:07:44.870911+0100", "src_ip": "64.62.156.126", "dest_ip": "185.254.126.122", "src_port": 43849, "dest_port": 9100}}');
INSERT INTO alerts VALUES(30,1772968071.505903006,'{"timestamp": "2026-03-08T12:07:51.505903+0100", "flow_id": 2172838372107286, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 4435, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:07:51.505903+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 4435}}');
INSERT INTO alerts VALUES(31,1772968086.532849074,'{"timestamp": "2026-03-08T12:08:06.532849+0100", "flow_id": 1725620693505979, "event_type": "alert", "src_ip": "87.121.84.93", "src_port": 48190, "dest_ip": "185.254.126.122", "dest_port": 8880, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:08:06.532849+0100", "src_ip": "87.121.84.93", "dest_ip": "185.254.126.122", "src_port": 48190, "dest_port": 8880}}');
INSERT INTO alerts VALUES(32,1772968121.220469952,'{"timestamp": "2026-03-08T12:08:41.220470+0100", "flow_id": 383964427788104, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 46392, "dest_ip": "185.254.126.122", "dest_port": 29037, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:08:41.220470+0100", "src_ip": "167.94.146.46", "dest_ip": "185.254.126.122", "src_port": 46392, "dest_port": 29037}}');
INSERT INTO alerts VALUES(33,1772968149.401411057,'{"timestamp": "2026-03-08T12:09:09.401411+0100", "flow_id": 1442573439966710, "event_type": "alert", "src_ip": "65.49.1.10", "src_port": 53486, "dest_ip": "185.254.126.122", "dest_port": 10161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 113, "bytes_toclient": 0, "start": "2026-03-08T12:09:09.401411+0100", "src_ip": "65.49.1.10", "dest_ip": "185.254.126.122", "src_port": 53486, "dest_port": 10161}}');
INSERT INTO alerts VALUES(34,1772968199.544286967,'{"timestamp": "2026-03-08T12:09:59.544287+0100", "flow_id": 2056224070135994, "event_type": "alert", "src_ip": "64.62.156.133", "src_port": 39958, "dest_ip": "185.254.126.122", "dest_port": 5002, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:09:59.544287+0100", "src_ip": "64.62.156.133", "dest_ip": "185.254.126.122", "src_port": 39958, "dest_port": 5002}}');
INSERT INTO alerts VALUES(35,1772968201.585504055,'{"timestamp": "2026-03-08T12:10:01.585504+0100", "flow_id": 544398986985878, "event_type": "alert", "src_ip": "222.121.250.156", "src_port": 59589, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2500024, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 13", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:10:01.585504+0100", "src_ip": "222.121.250.156", "dest_ip": "185.254.126.122", "src_port": 59589, "dest_port": 22}}');
INSERT INTO alerts VALUES(36,1772968288.524804115,'{"timestamp": "2026-03-08T12:11:28.524804+0100", "flow_id": 2219680630656, "event_type": "alert", "src_ip": "162.217.98.180", "src_port": 44080, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 413, "bytes_toclient": 0, "start": "2026-03-08T12:11:28.524804+0100", "src_ip": "162.217.98.180", "dest_ip": "185.254.126.122", "src_port": 44080, "dest_port": 5060}}');
INSERT INTO alerts VALUES(37,1772968596.773941994,'{"timestamp": "2026-03-08T12:16:36.773942+0100", "flow_id": 1353731259262247, "event_type": "alert", "src_ip": "162.142.125.82", "src_port": 12566, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:16:36.773942+0100", "src_ip": "162.142.125.82", "dest_ip": "185.254.126.122", "src_port": 12566, "dest_port": 1433}}');
INSERT INTO alerts VALUES(38,1772968626.081825018,'{"timestamp": "2026-03-08T12:17:06.081825+0100", "flow_id": 632913899514048, "event_type": "alert", "src_ip": "167.94.146.41", "src_port": 33761, "dest_ip": "185.254.126.122", "dest_port": 52258, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:17:06.081825+0100", "src_ip": "167.94.146.41", "dest_ip": "185.254.126.122", "src_port": 33761, "dest_port": 52258}}');
INSERT INTO alerts VALUES(39,1772968633.133125067,'{"timestamp": "2026-03-08T12:17:13.133125+0100", "flow_id": 290293931178159, "event_type": "alert", "src_ip": "64.62.156.119", "src_port": 60596, "dest_ip": "185.254.126.122", "dest_port": 12654, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:17:13.133125+0100", "src_ip": "64.62.156.119", "dest_ip": "185.254.126.122", "src_port": 60596, "dest_port": 12654}}');
INSERT INTO alerts VALUES(40,1772968701.930237054,'{"timestamp": "2026-03-08T12:18:21.930237+0100", "flow_id": 1462065537787378, "event_type": "alert", "src_ip": "193.163.125.22", "src_port": 59470, "dest_ip": "185.254.126.122", "dest_port": 2107, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:18:21.930237+0100", "src_ip": "193.163.125.22", "dest_ip": "185.254.126.122", "src_port": 59470, "dest_port": 2107}}');
INSERT INTO alerts VALUES(41,1772968715.270917892,'{"timestamp": "2026-03-08T12:18:35.270918+0100", "flow_id": 882112871753615, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3449, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:18:35.270918+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3449}}');
INSERT INTO alerts VALUES(42,1772968762.92970109,'{"timestamp": "2026-03-08T12:19:22.929701+0100", "flow_id": 615335874839180, "event_type": "alert", "src_ip": "64.62.156.46", "src_port": 51289, "dest_ip": "185.254.126.122", "dest_port": 1434, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-08T12:19:22.929701+0100", "src_ip": "64.62.156.46", "dest_ip": "185.254.126.122", "src_port": 51289, "dest_port": 1434}}');
INSERT INTO alerts VALUES(43,1772968772.597405911,'{"timestamp": "2026-03-08T12:19:32.597406+0100", "flow_id": 1158467582124100, "event_type": "alert", "src_ip": "64.62.156.131", "src_port": 51301, "dest_ip": "185.254.126.122", "dest_port": 5804, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:19:32.597406+0100", "src_ip": "64.62.156.131", "dest_ip": "185.254.126.122", "src_port": 51301, "dest_port": 5804}}');
INSERT INTO alerts VALUES(44,1772968815.08911705,'{"timestamp": "2026-03-08T12:20:15.089117+0100", "flow_id": 2071606956141737, "event_type": "alert", "src_ip": "193.163.125.5", "src_port": 52109, "dest_ip": "185.254.126.122", "dest_port": 10109, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:20:15.089117+0100", "src_ip": "193.163.125.5", "dest_ip": "185.254.126.122", "src_port": 52109, "dest_port": 10109}}');
INSERT INTO alerts VALUES(45,1772968829.135941982,'{"timestamp": "2026-03-08T12:20:29.135942+0100", "flow_id": 1428294391629193, "event_type": "alert", "src_ip": "65.49.1.193", "src_port": 51795, "dest_ip": "185.254.126.122", "dest_port": 9060, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:20:29.135942+0100", "src_ip": "65.49.1.193", "dest_ip": "185.254.126.122", "src_port": 51795, "dest_port": 9060}}');
INSERT INTO alerts VALUES(46,1772968987.806700945,'{"timestamp": "2026-03-08T12:23:07.806701+0100", "flow_id": 931483533319766, "event_type": "alert", "src_ip": "176.65.148.203", "src_port": 57395, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:23:07.806701+0100", "src_ip": "176.65.148.203", "dest_ip": "185.254.126.122", "src_port": 57395, "dest_port": 8088}}');
INSERT INTO alerts VALUES(47,1772968987.806700945,'{"timestamp": "2026-03-08T12:23:07.806701+0100", "flow_id": 931483533319766, "event_type": "alert", "src_ip": "176.65.148.203", "src_port": 57395, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:23:07.806701+0100", "src_ip": "176.65.148.203", "dest_ip": "185.254.126.122", "src_port": 57395, "dest_port": 8088}}');
INSERT INTO alerts VALUES(48,1772968987.806700945,'{"timestamp": "2026-03-08T12:23:07.806701+0100", "flow_id": 931483533319766, "event_type": "alert", "src_ip": "176.65.148.203", "src_port": 57395, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500018, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:23:07.806701+0100", "src_ip": "176.65.148.203", "dest_ip": "185.254.126.122", "src_port": 57395, "dest_port": 8088}}');
INSERT INTO alerts VALUES(49,1772968994.488075017,'{"timestamp": "2026-03-08T12:23:14.488075+0100", "flow_id": 688894393701528, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57159, "dest_ip": "185.254.126.122", "dest_port": 8089, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:23:14.488075+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57159, "dest_port": 8089}}');
INSERT INTO alerts VALUES(50,1772968994.488075017,'{"timestamp": "2026-03-08T12:23:14.488075+0100", "flow_id": 688894393701528, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57159, "dest_ip": "185.254.126.122", "dest_port": 8089, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:23:14.488075+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57159, "dest_port": 8089}}');
INSERT INTO alerts VALUES(51,1772969043.623117923,'{"timestamp": "2026-03-08T12:24:03.623118+0100", "flow_id": 987423258847880, "event_type": "alert", "src_ip": "45.156.87.91", "src_port": 52282, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:24:03.623118+0100", "src_ip": "45.156.87.91", "dest_ip": "185.254.126.122", "src_port": 52282, "dest_port": 8080}}');
INSERT INTO alerts VALUES(52,1772969136.564893007,'{"timestamp": "2026-03-08T12:25:36.564893+0100", "flow_id": 174398044913935, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 57816, "dest_ip": "185.254.126.122", "dest_port": 33333, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:25:36.564893+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 57816, "dest_port": 33333}}');
INSERT INTO alerts VALUES(53,1772969227.363162994,'{"timestamp": "2026-03-08T12:27:07.363163+0100", "flow_id": 996826649483882, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 32059, "dest_ip": "185.254.126.122", "dest_port": 3529, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:27:07.363163+0100", "src_ip": "167.94.146.42", "dest_ip": "185.254.126.122", "src_port": 32059, "dest_port": 3529}}');
INSERT INTO alerts VALUES(54,1772969230.134435892,'{"timestamp": "2026-03-08T12:27:10.134436+0100", "flow_id": 1703300492465607, "event_type": "alert", "src_ip": "45.153.34.32", "src_port": 46420, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:27:10.134436+0100", "src_ip": "45.153.34.32", "dest_ip": "185.254.126.122", "src_port": 46420, "dest_port": 3306}}');
INSERT INTO alerts VALUES(55,1772969230.134435892,'{"timestamp": "2026-03-08T12:27:10.134436+0100", "flow_id": 1703300492465607, "event_type": "alert", "src_ip": "45.153.34.32", "src_port": 46420, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:27:10.134436+0100", "src_ip": "45.153.34.32", "dest_ip": "185.254.126.122", "src_port": 46420, "dest_port": 3306}}');
INSERT INTO alerts VALUES(56,1772969231.584532022,'{"timestamp": "2026-03-08T12:27:11.584532+0100", "flow_id": 2229074908694708, "event_type": "alert", "src_ip": "64.62.197.104", "src_port": 47003, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:27:11.584532+0100", "src_ip": "64.62.197.104", "dest_ip": "185.254.126.122", "src_port": 47003, "dest_port": 3389}}');
INSERT INTO alerts VALUES(57,1772969244.378140927,'{"timestamp": "2026-03-08T12:27:24.378141+0100", "flow_id": 1342628541923666, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 44065, "dest_ip": "185.254.126.122", "dest_port": 1765, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:27:24.378141+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 44065, "dest_port": 1765}}');
INSERT INTO alerts VALUES(58,1772969244.857228995,'{"timestamp": "2026-03-08T12:27:24.857229+0100", "flow_id": 1148497289724770, "event_type": "alert", "src_ip": "64.62.156.196", "src_port": 44826, "dest_ip": "185.254.126.122", "dest_port": 20001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:27:24.857229+0100", "src_ip": "64.62.156.196", "dest_ip": "185.254.126.122", "src_port": 44826, "dest_port": 20001}}');
INSERT INTO alerts VALUES(59,1772969396.067214965,'{"timestamp": "2026-03-08T12:29:56.067215+0100", "flow_id": 1133111273325284, "event_type": "alert", "src_ip": "186.155.41.54", "src_port": 54451, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:29:56.067215+0100", "src_ip": "186.155.41.54", "dest_ip": "185.254.126.122", "src_port": 54451, "dest_port": 1433}}');
INSERT INTO alerts VALUES(60,1772969396.067708015,'{"timestamp": "2026-03-08T12:29:56.067708+0100", "flow_id": 1133111273325284, "event_type": "alert", "src_ip": "186.155.41.54", "src_port": 54451, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 80, "bytes_toclient": 0, "start": "2026-03-08T12:29:56.067215+0100", "src_ip": "186.155.41.54", "dest_ip": "185.254.126.122", "src_port": 54451, "dest_port": 1433}}');
INSERT INTO alerts VALUES(61,1772969454.749866008,'{"timestamp": "2026-03-08T12:30:54.749866+0100", "flow_id": 1813278450468078, "event_type": "alert", "src_ip": "167.94.146.44", "src_port": 20041, "dest_ip": "185.254.126.122", "dest_port": 28945, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:30:54.749866+0100", "src_ip": "167.94.146.44", "dest_ip": "185.254.126.122", "src_port": 20041, "dest_port": 28945}}');
INSERT INTO alerts VALUES(62,1772969455.414401054,'{"timestamp": "2026-03-08T12:30:55.414401+0100", "flow_id": 2061316693334352, "event_type": "alert", "src_ip": "124.128.247.169", "src_port": 49392, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:30:55.414401+0100", "src_ip": "124.128.247.169", "dest_ip": "185.254.126.122", "src_port": 49392, "dest_port": 1433}}');
INSERT INTO alerts VALUES(63,1772969485.985836983,'{"timestamp": "2026-03-08T12:31:25.985837+0100", "flow_id": 1419390800542631, "event_type": "alert", "src_ip": "185.242.226.17", "src_port": 35097, "dest_ip": "185.254.126.122", "dest_port": 5985, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:31:25.985837+0100", "src_ip": "185.242.226.17", "dest_ip": "185.254.126.122", "src_port": 35097, "dest_port": 5985}}');
INSERT INTO alerts VALUES(64,1772969503.767944098,'{"timestamp": "2026-03-08T12:31:43.767944+0100", "flow_id": 2172396000345852, "event_type": "alert", "src_ip": "147.185.132.176", "src_port": 50233, "dest_ip": "185.254.126.122", "dest_port": 2200, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:31:43.767944+0100", "src_ip": "147.185.132.176", "dest_ip": "185.254.126.122", "src_port": 50233, "dest_port": 2200}}');
INSERT INTO alerts VALUES(65,1772969520.518975019,'{"timestamp": "2026-03-08T12:32:00.518975+0100", "flow_id": 258658261704279, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 34745, "dest_ip": "185.254.126.122", "dest_port": 1022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:32:00.518975+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 34745, "dest_port": 1022}}');
INSERT INTO alerts VALUES(66,1772969520.518975019,'{"timestamp": "2026-03-08T12:32:00.518975+0100", "flow_id": 258658261704279, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 34745, "dest_ip": "185.254.126.122", "dest_port": 1022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:32:00.518975+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 34745, "dest_port": 1022}}');
INSERT INTO alerts VALUES(67,1772969538.957374096,'{"timestamp": "2026-03-08T12:32:18.957374+0100", "flow_id": 734191275054246, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 14408, "dest_ip": "185.254.126.122", "dest_port": 41664, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:32:18.957374+0100", "src_ip": "167.94.146.35", "dest_ip": "185.254.126.122", "src_port": 14408, "dest_port": 41664}}');
INSERT INTO alerts VALUES(68,1772969540.911106109,'{"timestamp": "2026-03-08T12:32:20.911106+0100", "flow_id": 1379897170670676, "event_type": "alert", "src_ip": "64.62.197.40", "src_port": 46274, "dest_ip": "185.254.126.122", "dest_port": 1001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:32:20.911106+0100", "src_ip": "64.62.197.40", "dest_ip": "185.254.126.122", "src_port": 46274, "dest_port": 1001}}');
INSERT INTO alerts VALUES(69,1772969549.175812959,'{"timestamp": "2026-03-08T12:32:29.175813+0100", "flow_id": 1599539118572869, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 54839, "dest_ip": "185.254.126.122", "dest_port": 4207, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:32:29.175813+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 54839, "dest_port": 4207}}');
INSERT INTO alerts VALUES(70,1772969589.124248028,'{"timestamp": "2026-03-08T12:33:09.124248+0100", "flow_id": 1659545065564564, "event_type": "alert", "src_ip": "178.20.210.151", "src_port": 44371, "dest_ip": "185.254.126.122", "dest_port": 60022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:33:09.124248+0100", "src_ip": "178.20.210.151", "dest_ip": "185.254.126.122", "src_port": 44371, "dest_port": 60022}}');
INSERT INTO alerts VALUES(71,1772969675.490051032,'{"timestamp": "2026-03-08T12:34:35.490051+0100", "flow_id": 978855372649284, "event_type": "alert", "src_ip": "176.65.148.204", "src_port": 54265, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:34:35.490051+0100", "src_ip": "176.65.148.204", "dest_ip": "185.254.126.122", "src_port": 54265, "dest_port": 25565}}');
INSERT INTO alerts VALUES(72,1772969675.490051032,'{"timestamp": "2026-03-08T12:34:35.490051+0100", "flow_id": 978855372649284, "event_type": "alert", "src_ip": "176.65.148.204", "src_port": 54265, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:34:35.490051+0100", "src_ip": "176.65.148.204", "dest_ip": "185.254.126.122", "src_port": 54265, "dest_port": 25565}}');
INSERT INTO alerts VALUES(73,1772969676.924386025,'{"timestamp": "2026-03-08T12:34:36.924386+0100", "flow_id": 1155460185359247, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 40486, "dest_ip": "185.254.126.122", "dest_port": 1176, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:34:36.924386+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 40486, "dest_port": 1176}}');
INSERT INTO alerts VALUES(74,1772969706.614317893,'{"timestamp": "2026-03-08T12:35:06.614318+0100", "flow_id": 668151414313374, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 48403, "dest_ip": "185.254.126.122", "dest_port": 2001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:35:06.614318+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 48403, "dest_port": 2001}}');
INSERT INTO alerts VALUES(75,1772969706.614317893,'{"timestamp": "2026-03-08T12:35:06.614318+0100", "flow_id": 668151414313374, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 48403, "dest_ip": "185.254.126.122", "dest_port": 2001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:35:06.614318+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 48403, "dest_port": 2001}}');
INSERT INTO alerts VALUES(76,1772969708.039972067,'{"timestamp": "2026-03-08T12:35:08.039972+0100", "flow_id": 1297580871552892, "event_type": "alert", "src_ip": "101.0.104.38", "src_port": 5067, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 436, "bytes_toclient": 0, "start": "2026-03-08T12:35:08.039972+0100", "src_ip": "101.0.104.38", "dest_ip": "185.254.126.122", "src_port": 5067, "dest_port": 5060}}');
INSERT INTO alerts VALUES(77,1772969708.039972067,'{"timestamp": "2026-03-08T12:35:08.039972+0100", "flow_id": 1297580871552892, "event_type": "alert", "src_ip": "101.0.104.38", "src_port": 5067, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 436, "bytes_toclient": 0, "start": "2026-03-08T12:35:08.039972+0100", "src_ip": "101.0.104.38", "dest_ip": "185.254.126.122", "src_port": 5067, "dest_port": 5060}}');
INSERT INTO alerts VALUES(78,1772969738.882935047,'{"timestamp": "2026-03-08T12:35:38.882935+0100", "flow_id": 695952245243912, "event_type": "alert", "src_ip": "167.94.146.36", "src_port": 24606, "dest_ip": "185.254.126.122", "dest_port": 56924, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:35:38.882935+0100", "src_ip": "167.94.146.36", "dest_ip": "185.254.126.122", "src_port": 24606, "dest_port": 56924}}');
INSERT INTO alerts VALUES(79,1772969778.631633044,'{"timestamp": "2026-03-08T12:36:18.631633+0100", "flow_id": 742520687020377, "event_type": "alert", "src_ip": "167.94.138.153", "src_port": 17380, "dest_ip": "185.254.126.122", "dest_port": 2362, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 42, "bytes_toclient": 0, "start": "2026-03-08T12:36:18.631633+0100", "src_ip": "167.94.138.153", "dest_ip": "185.254.126.122", "src_port": 17380, "dest_port": 2362}}');
INSERT INTO alerts VALUES(80,1772969823.559125901,'{"timestamp": "2026-03-08T12:37:03.559126+0100", "flow_id": 2119954413435314, "event_type": "alert", "src_ip": "147.185.132.244", "src_port": 54469, "dest_ip": "185.254.126.122", "dest_port": 45101, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:37:03.559126+0100", "src_ip": "147.185.132.244", "dest_ip": "185.254.126.122", "src_port": 54469, "dest_port": 45101}}');
INSERT INTO alerts VALUES(81,1772969848.610964059,'{"timestamp": "2026-03-08T12:37:28.610964+0100", "flow_id": 90798536647977, "event_type": "alert", "src_ip": "147.185.132.14", "src_port": 50840, "dest_ip": "185.254.126.122", "dest_port": 9040, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:37:28.610964+0100", "src_ip": "147.185.132.14", "dest_ip": "185.254.126.122", "src_port": 50840, "dest_port": 9040}}');
INSERT INTO alerts VALUES(82,1772969872.024569035,'{"timestamp": "2026-03-08T12:37:52.024569+0100", "flow_id": 105526143122168, "event_type": "alert", "src_ip": "64.62.156.184", "src_port": 42784, "dest_ip": "185.254.126.122", "dest_port": 24156, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:37:52.024569+0100", "src_ip": "64.62.156.184", "dest_ip": "185.254.126.122", "src_port": 42784, "dest_port": 24156}}');
INSERT INTO alerts VALUES(83,1772969949.980952025,'{"timestamp": "2026-03-08T12:39:09.980952+0100", "flow_id": 1679883118561756, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 20906, "dest_ip": "185.254.126.122", "dest_port": 23868, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:39:09.980952+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 20906, "dest_port": 23868}}');
INSERT INTO alerts VALUES(84,1772969976.840507984,'{"timestamp": "2026-03-08T12:39:36.840508+0100", "flow_id": 232255189805329, "event_type": "alert", "src_ip": "192.109.200.157", "src_port": 34196, "dest_ip": "185.254.126.122", "dest_port": 34567, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:39:36.840508+0100", "src_ip": "192.109.200.157", "dest_ip": "185.254.126.122", "src_port": 34196, "dest_port": 34567}}');
INSERT INTO alerts VALUES(85,1772970061.731421948,'{"timestamp": "2026-03-08T12:41:01.731422+0100", "flow_id": 1452587357184737, "event_type": "alert", "src_ip": "64.62.156.94", "src_port": 51658, "dest_ip": "185.254.126.122", "dest_port": 5683, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 49, "bytes_toclient": 0, "start": "2026-03-08T12:41:01.731422+0100", "src_ip": "64.62.156.94", "dest_ip": "185.254.126.122", "src_port": 51658, "dest_port": 5683}}');
INSERT INTO alerts VALUES(86,1772970126.185158967,'{"timestamp": "2026-03-08T12:42:06.185159+0100", "flow_id": 1921153051424606, "event_type": "alert", "src_ip": "167.94.146.47", "src_port": 2199, "dest_ip": "185.254.126.122", "dest_port": 63391, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:42:06.185159+0100", "src_ip": "167.94.146.47", "dest_ip": "185.254.126.122", "src_port": 2199, "dest_port": 63391}}');
INSERT INTO alerts VALUES(87,1772970233.540241003,'{"timestamp": "2026-03-08T12:43:53.540241+0100", "flow_id": 349992661968521, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 48351, "dest_ip": "185.254.126.122", "dest_port": 18080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:43:53.540241+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 48351, "dest_port": 18080}}');
INSERT INTO alerts VALUES(88,1772970244.024663925,'{"timestamp": "2026-03-08T12:44:04.024664+0100", "flow_id": 1231833748404555, "event_type": "alert", "src_ip": "147.185.132.254", "src_port": 51595, "dest_ip": "185.254.126.122", "dest_port": 9588, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:44:04.024664+0100", "src_ip": "147.185.132.254", "dest_ip": "185.254.126.122", "src_port": 51595, "dest_port": 9588}}');
INSERT INTO alerts VALUES(89,1772970275.705806017,'{"timestamp": "2026-03-08T12:44:35.705806+0100", "flow_id": 1061093082999947, "event_type": "alert", "src_ip": "176.65.149.194", "src_port": 43039, "dest_ip": "185.254.126.122", "dest_port": 5005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:44:35.705806+0100", "src_ip": "176.65.149.194", "dest_ip": "185.254.126.122", "src_port": 43039, "dest_port": 5005}}');
INSERT INTO alerts VALUES(90,1772970318.780030012,'{"timestamp": "2026-03-08T12:45:18.780030+0100", "flow_id": 1942829923301587, "event_type": "alert", "src_ip": "147.185.132.130", "src_port": 49227, "dest_ip": "185.254.126.122", "dest_port": 13000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:45:18.780030+0100", "src_ip": "147.185.132.130", "dest_ip": "185.254.126.122", "src_port": 49227, "dest_port": 13000}}');
INSERT INTO alerts VALUES(91,1772970417.928836107,'{"timestamp": "2026-03-08T12:46:57.928836+0100", "flow_id": 330148858282879, "event_type": "alert", "src_ip": "167.94.138.155", "src_port": 7127, "dest_ip": "185.254.126.122", "dest_port": 52200, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:46:57.928836+0100", "src_ip": "167.94.138.155", "dest_ip": "185.254.126.122", "src_port": 7127, "dest_port": 52200}}');
INSERT INTO alerts VALUES(92,1772970423.654944897,'{"timestamp": "2026-03-08T12:47:03.654945+0100", "flow_id": 2250019849755167, "event_type": "alert", "src_ip": "147.185.132.44", "src_port": 54016, "dest_ip": "185.254.126.122", "dest_port": 52110, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:47:03.654945+0100", "src_ip": "147.185.132.44", "dest_ip": "185.254.126.122", "src_port": 54016, "dest_port": 52110}}');
INSERT INTO alerts VALUES(93,1772970448.13249302,'{"timestamp": "2026-03-08T12:47:28.132493+0100", "flow_id": 6106737805137, "event_type": "alert", "src_ip": "88.210.63.193", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 1443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:47:28.132493+0100", "src_ip": "88.210.63.193", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 1443}}');
INSERT INTO alerts VALUES(94,1772970530.874842882,'{"timestamp": "2026-03-08T12:48:50.874843+0100", "flow_id": 661199746636833, "event_type": "alert", "src_ip": "204.76.203.73", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 5080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:48:50.874843+0100", "src_ip": "204.76.203.73", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 5080}}');
INSERT INTO alerts VALUES(95,1772970530.874842882,'{"timestamp": "2026-03-08T12:48:50.874843+0100", "flow_id": 661199746636833, "event_type": "alert", "src_ip": "204.76.203.73", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 5080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:48:50.874843+0100", "src_ip": "204.76.203.73", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 5080}}');
INSERT INTO alerts VALUES(96,1772970533.740964889,'{"timestamp": "2026-03-08T12:48:53.740965+0100", "flow_id": 1493574562761147, "event_type": "alert", "src_ip": "165.154.182.207", "src_port": 43439, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:48:53.740965+0100", "src_ip": "165.154.182.207", "dest_ip": "185.254.126.122", "src_port": 43439, "dest_port": 1521}}');
INSERT INTO alerts VALUES(97,1772970642.64416194,'{"timestamp": "2026-03-08T12:50:42.644162+0100", "flow_id": 796332903287087, "event_type": "alert", "src_ip": "64.62.197.36", "src_port": 36142, "dest_ip": "185.254.126.122", "dest_port": 143, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:50:42.644162+0100", "src_ip": "64.62.197.36", "dest_ip": "185.254.126.122", "src_port": 36142, "dest_port": 143}}');
INSERT INTO alerts VALUES(98,1772970686.149171114,'{"timestamp": "2026-03-08T12:51:26.149171+0100", "flow_id": 1766584935590848, "event_type": "alert", "src_ip": "190.26.208.130", "src_port": 17540, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:51:26.149171+0100", "src_ip": "190.26.208.130", "dest_ip": "185.254.126.122", "src_port": 17540, "dest_port": 1433}}');
INSERT INTO alerts VALUES(99,1772970705.723393917,'{"timestamp": "2026-03-08T12:51:45.723394+0100", "flow_id": 292206732422533, "event_type": "alert", "src_ip": "185.242.226.68", "src_port": 52208, "dest_ip": "185.254.126.122", "dest_port": 6999, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-08T12:51:45.723394+0100", "src_ip": "185.242.226.68", "dest_ip": "185.254.126.122", "src_port": 52208, "dest_port": 6999}}');
INSERT INTO alerts VALUES(100,1772970713.364567996,'{"timestamp": "2026-03-08T12:51:53.364568+0100", "flow_id": 439911588205995, "event_type": "alert", "src_ip": "64.62.197.171", "src_port": 58441, "dest_ip": "185.254.126.122", "dest_port": 49666, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:51:53.364568+0100", "src_ip": "64.62.197.171", "dest_ip": "185.254.126.122", "src_port": 58441, "dest_port": 49666}}');
INSERT INTO alerts VALUES(101,1772970726.134099006,'{"timestamp": "2026-03-08T12:52:06.134099+0100", "flow_id": 1701852578689491, "event_type": "alert", "src_ip": "64.89.163.23", "src_port": 49191, "dest_ip": "185.254.126.122", "dest_port": 587, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:52:06.134099+0100", "src_ip": "64.89.163.23", "dest_ip": "185.254.126.122", "src_port": 49191, "dest_port": 587}}');
INSERT INTO alerts VALUES(102,1772970833.377430916,'{"timestamp": "2026-03-08T12:53:53.377431+0100", "flow_id": 495155639860306, "event_type": "alert", "src_ip": "147.185.132.107", "src_port": 55072, "dest_ip": "185.254.126.122", "dest_port": 46895, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:53:53.377431+0100", "src_ip": "147.185.132.107", "dest_ip": "185.254.126.122", "src_port": 55072, "dest_port": 46895}}');
INSERT INTO alerts VALUES(103,1772970847.462182045,'{"timestamp": "2026-03-08T12:54:07.462182+0100", "flow_id": 1985058708004696, "event_type": "alert", "src_ip": "176.65.148.197", "src_port": 45968, "dest_ip": "185.254.126.122", "dest_port": 5006, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:54:07.462182+0100", "src_ip": "176.65.148.197", "dest_ip": "185.254.126.122", "src_port": 45968, "dest_port": 5006}}');
INSERT INTO alerts VALUES(104,1772970847.462182045,'{"timestamp": "2026-03-08T12:54:07.462182+0100", "flow_id": 1985058708004696, "event_type": "alert", "src_ip": "176.65.148.197", "src_port": 45968, "dest_ip": "185.254.126.122", "dest_port": 5006, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:54:07.462182+0100", "src_ip": "176.65.148.197", "dest_ip": "185.254.126.122", "src_port": 45968, "dest_port": 5006}}');
INSERT INTO alerts VALUES(105,1772970860.434972048,'{"timestamp": "2026-03-08T12:54:20.434972+0100", "flow_id": 1305242660097052, "event_type": "alert", "src_ip": "185.156.73.181", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 64436, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:54:20.434972+0100", "src_ip": "185.156.73.181", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 64436}}');
INSERT INTO alerts VALUES(106,1772970876.915090085,'{"timestamp": "2026-03-08T12:54:36.915090+0100", "flow_id": 1397008129464063, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 32985, "dest_ip": "185.254.126.122", "dest_port": 55595, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T12:54:36.915090+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 32985, "dest_port": 55595}}');
INSERT INTO alerts VALUES(107,1772970975.931539058,'{"timestamp": "2026-03-08T12:56:15.931539+0100", "flow_id": 2030607631199649, "event_type": "alert", "src_ip": "193.163.125.19", "src_port": 56298, "dest_ip": "185.254.126.122", "dest_port": 8083, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:56:15.931539+0100", "src_ip": "193.163.125.19", "dest_ip": "185.254.126.122", "src_port": 56298, "dest_port": 8083}}');
INSERT INTO alerts VALUES(108,1772970976.134443044,'{"timestamp": "2026-03-08T12:56:16.134443+0100", "flow_id": 14480115273459, "event_type": "alert", "src_ip": "46.151.182.45", "src_port": 46126, "dest_ip": "185.254.126.122", "dest_port": 2080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:56:16.134443+0100", "src_ip": "46.151.182.45", "dest_ip": "185.254.126.122", "src_port": 46126, "dest_port": 2080}}');
INSERT INTO alerts VALUES(109,1772971035.564723014,'{"timestamp": "2026-03-08T12:57:15.564723+0100", "flow_id": 1018093094413412, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 33997, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:57:15.564723+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 33997, "dest_port": 8332}}');
INSERT INTO alerts VALUES(110,1772971035.564723014,'{"timestamp": "2026-03-08T12:57:15.564723+0100", "flow_id": 1018093094413412, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 33997, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T12:57:15.564723+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 33997, "dest_port": 8332}}');
INSERT INTO alerts VALUES(111,1772971126.148916006,'{"timestamp": "2026-03-08T12:58:46.148916+0100", "flow_id": 1765493161747515, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 12587, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:58:46.148916+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 12587}}');
INSERT INTO alerts VALUES(112,1772971136.582801104,'{"timestamp": "2026-03-08T12:58:56.582801+0100", "flow_id": 251314566996962, "event_type": "alert", "src_ip": "185.156.73.182", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 8085, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T12:58:56.582801+0100", "src_ip": "185.156.73.182", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 8085}}');
INSERT INTO alerts VALUES(113,1772971158.590765,'{"timestamp": "2026-03-08T12:59:18.590765+0100", "flow_id": 1692892284103529, "event_type": "alert", "src_ip": "147.185.132.124", "src_port": 56768, "dest_ip": "185.254.126.122", "dest_port": 7080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T12:59:18.590765+0100", "src_ip": "147.185.132.124", "dest_ip": "185.254.126.122", "src_port": 56768, "dest_port": 7080}}');
INSERT INTO alerts VALUES(114,1772971238.954747915,'{"timestamp": "2026-03-08T13:00:38.954748+0100", "flow_id": 1848811938633137, "event_type": "alert", "src_ip": "87.121.84.85", "src_port": 40128, "dest_ip": "185.254.126.122", "dest_port": 2011, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:00:38.954748+0100", "src_ip": "87.121.84.85", "dest_ip": "185.254.126.122", "src_port": 40128, "dest_port": 2011}}');
INSERT INTO alerts VALUES(115,1772971304.47939992,'{"timestamp": "2026-03-08T13:01:44.479400+0100", "flow_id": 88684102664093, "event_type": "alert", "src_ip": "193.163.125.6", "src_port": 56193, "dest_ip": "185.254.126.122", "dest_port": 9595, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:01:44.479400+0100", "src_ip": "193.163.125.6", "dest_ip": "185.254.126.122", "src_port": 56193, "dest_port": 9595}}');
INSERT INTO alerts VALUES(116,1772971307.622184991,'{"timestamp": "2026-03-08T13:01:47.622185+0100", "flow_id": 983416158379710, "event_type": "alert", "src_ip": "147.185.132.142", "src_port": 56685, "dest_ip": "185.254.126.122", "dest_port": 34465, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:01:47.622185+0100", "src_ip": "147.185.132.142", "dest_ip": "185.254.126.122", "src_port": 56685, "dest_port": 34465}}');
INSERT INTO alerts VALUES(117,1772971351.772161961,'{"timestamp": "2026-03-08T13:02:31.772162+0100", "flow_id": 2190513127722926, "event_type": "alert", "src_ip": "65.49.1.230", "src_port": 59832, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:02:31.772162+0100", "src_ip": "65.49.1.230", "dest_ip": "185.254.126.122", "src_port": 59832, "dest_port": 23}}');
INSERT INTO alerts VALUES(118,1772971358.014561891,'{"timestamp": "2026-03-08T13:02:38.014562+0100", "flow_id": 1751394306380374, "event_type": "alert", "src_ip": "176.65.149.182", "src_port": 42870, "dest_ip": "185.254.126.122", "dest_port": 8118, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:02:38.014562+0100", "src_ip": "176.65.149.182", "dest_ip": "185.254.126.122", "src_port": 42870, "dest_port": 8118}}');
INSERT INTO alerts VALUES(119,1772971424.335268021,'{"timestamp": "2026-03-08T13:03:44.335268+0100", "flow_id": 32593150578692, "event_type": "alert", "src_ip": "91.196.152.148", "src_port": 56888, "dest_ip": "185.254.126.122", "dest_port": 50075, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:03:44.335268+0100", "src_ip": "91.196.152.148", "dest_ip": "185.254.126.122", "src_port": 56888, "dest_port": 50075}}');
INSERT INTO alerts VALUES(120,1772971424.663022042,'{"timestamp": "2026-03-08T13:03:44.663022+0100", "flow_id": 32911587173041, "event_type": "alert", "src_ip": "65.49.1.235", "src_port": 59317, "dest_ip": "185.254.126.122", "dest_port": 5007, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:03:44.663022+0100", "src_ip": "65.49.1.235", "dest_ip": "185.254.126.122", "src_port": 59317, "dest_port": 5007}}');
INSERT INTO alerts VALUES(121,1772971441.056242943,'{"timestamp": "2026-03-08T13:04:01.056243+0100", "flow_id": 523039813263406, "event_type": "alert", "src_ip": "176.65.139.31", "src_port": 46887, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 67, "bytes_toclient": 0, "start": "2026-03-08T13:04:01.056243+0100", "src_ip": "176.65.139.31", "dest_ip": "185.254.126.122", "src_port": 46887, "dest_port": 389}}');
INSERT INTO alerts VALUES(122,1772971522.527390003,'{"timestamp": "2026-03-08T13:05:22.527390+0100", "flow_id": 576276115960110, "event_type": "alert", "src_ip": "65.49.20.116", "src_port": 39143, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:05:22.527390+0100", "src_ip": "65.49.20.116", "dest_ip": "185.254.126.122", "src_port": 39143, "dest_port": 3306}}');
INSERT INTO alerts VALUES(123,1772971565.188852071,'{"timestamp": "2026-03-08T13:06:05.188852+0100", "flow_id": 1655541670352639, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 48716, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:06:05.188852+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 48716, "dest_port": 3389}}');
INSERT INTO alerts VALUES(124,1772971631.725609064,'{"timestamp": "2026-03-08T13:07:11.725609+0100", "flow_id": 1990569993677657, "event_type": "alert", "src_ip": "193.163.125.32", "src_port": 46411, "dest_ip": "185.254.126.122", "dest_port": 20404, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:07:11.725609+0100", "src_ip": "193.163.125.32", "dest_ip": "185.254.126.122", "src_port": 46411, "dest_port": 20404}}');
INSERT INTO alerts VALUES(125,1772971634.588442088,'{"timestamp": "2026-03-08T13:07:14.588442+0100", "flow_id": 838491663349271, "event_type": "alert", "src_ip": "66.132.153.151", "src_port": 29034, "dest_ip": "185.254.126.122", "dest_port": 47001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:07:14.588442+0100", "src_ip": "66.132.153.151", "dest_ip": "185.254.126.122", "src_port": 29034, "dest_port": 47001}}');
INSERT INTO alerts VALUES(126,1772971787.879647016,'{"timestamp": "2026-03-08T13:09:47.879647+0100", "flow_id": 963308864515602, "event_type": "alert", "src_ip": "185.242.3.212", "src_port": 49334, "dest_ip": "185.254.126.122", "dest_port": 14147, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:09:47.879647+0100", "src_ip": "185.242.3.212", "dest_ip": "185.254.126.122", "src_port": 49334, "dest_port": 14147}}');
INSERT INTO alerts VALUES(127,1772971838.892843008,'{"timestamp": "2026-03-08T13:10:38.892843+0100", "flow_id": 1864409081642923, "event_type": "alert", "src_ip": "64.89.160.135", "src_port": 58000, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:10:38.892843+0100", "src_ip": "64.89.160.135", "dest_ip": "185.254.126.122", "src_port": 58000, "dest_port": 22}}');
INSERT INTO alerts VALUES(128,1772971896.958273887,'{"timestamp": "2026-03-08T13:11:36.958274+0100", "flow_id": 175106094416209, "event_type": "alert", "src_ip": "193.163.125.2", "src_port": 48105, "dest_ip": "185.254.126.122", "dest_port": 2096, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:11:36.958274+0100", "src_ip": "193.163.125.2", "dest_ip": "185.254.126.122", "src_port": 48105, "dest_port": 2096}}');
INSERT INTO alerts VALUES(129,1772971898.189261913,'{"timestamp": "2026-03-08T13:11:38.189262+0100", "flow_id": 812877863051322, "event_type": "alert", "src_ip": "64.62.156.150", "src_port": 58537, "dest_ip": "185.254.126.122", "dest_port": 57722, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:11:38.189262+0100", "src_ip": "64.62.156.150", "dest_ip": "185.254.126.122", "src_port": 58537, "dest_port": 57722}}');
INSERT INTO alerts VALUES(130,1772971901.511260033,'{"timestamp": "2026-03-08T13:11:41.511260+0100", "flow_id": 1632896229854465, "event_type": "alert", "src_ip": "65.49.1.17", "src_port": 35052, "dest_ip": "185.254.126.122", "dest_port": 10074, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 34, "bytes_toclient": 0, "start": "2026-03-08T13:11:41.511260+0100", "src_ip": "65.49.1.17", "dest_ip": "185.254.126.122", "src_port": 35052, "dest_port": 10074}}');
INSERT INTO alerts VALUES(131,1772971931.215141058,'{"timestamp": "2026-03-08T13:12:11.215141+0100", "flow_id": 924026505670613, "event_type": "alert", "src_ip": "64.62.197.8", "src_port": 37088, "dest_ip": "185.254.126.122", "dest_port": 4001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:12:11.215141+0100", "src_ip": "64.62.197.8", "dest_ip": "185.254.126.122", "src_port": 37088, "dest_port": 4001}}');
INSERT INTO alerts VALUES(132,1772971965.299175024,'{"timestamp": "2026-03-08T13:12:45.299175+0100", "flow_id": 1566425049670594, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 48725, "dest_ip": "185.254.126.122", "dest_port": 611, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:12:45.299175+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 48725, "dest_port": 611}}');
INSERT INTO alerts VALUES(133,1772971992.90737009,'{"timestamp": "2026-03-08T13:13:12.907370+0100", "flow_id": 237950574130844, "event_type": "alert", "src_ip": "45.153.34.187", "src_port": 34965, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:13:12.907370+0100", "src_ip": "45.153.34.187", "dest_ip": "185.254.126.122", "src_port": 34965, "dest_port": 80}}');
INSERT INTO alerts VALUES(134,1772971999.063530922,'{"timestamp": "2026-03-08T13:13:19.063531+0100", "flow_id": 2243190861642602, "event_type": "alert", "src_ip": "80.94.92.168", "src_port": 38216, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:13:19.063531+0100", "src_ip": "80.94.92.168", "dest_ip": "185.254.126.122", "src_port": 38216, "dest_port": 22}}');
INSERT INTO alerts VALUES(135,1772972040.162509918,'{"timestamp": "2026-03-08T13:14:00.162510+0100", "flow_id": 135025382767463, "event_type": "alert", "src_ip": "193.163.125.20", "src_port": 57287, "dest_ip": "185.254.126.122", "dest_port": 7022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:14:00.162510+0100", "src_ip": "193.163.125.20", "dest_ip": "185.254.126.122", "src_port": 57287, "dest_port": 7022}}');
INSERT INTO alerts VALUES(136,1772972097.109163045,'{"timestamp": "2026-03-08T13:14:57.109163+0100", "flow_id": 468853251673517, "event_type": "alert", "src_ip": "81.29.142.50", "src_port": 53524, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:14:57.109163+0100", "src_ip": "81.29.142.50", "dest_ip": "185.254.126.122", "src_port": 53524, "dest_port": 5432}}');
INSERT INTO alerts VALUES(137,1772972173.800925016,'{"timestamp": "2026-03-08T13:16:13.800925+0100", "flow_id": 1469622167206561, "event_type": "alert", "src_ip": "147.185.132.235", "src_port": 53899, "dest_ip": "185.254.126.122", "dest_port": 48847, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:16:13.800925+0100", "src_ip": "147.185.132.235", "dest_ip": "185.254.126.122", "src_port": 53899, "dest_port": 48847}}');
INSERT INTO alerts VALUES(138,1772972221.966645957,'{"timestamp": "2026-03-08T13:17:01.966646+0100", "flow_id": 1618439119854971, "event_type": "alert", "src_ip": "192.168.2.20", "src_port": 61351, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2057745, "rev": 1, "signature": "ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_11_20"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_11_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 5203, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "kaufradar-teaser.pages.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 72, "bytes_toclient": 0, "start": "2026-03-08T13:17:01.966646+0100", "src_ip": "192.168.2.20", "dest_ip": "192.168.2.1", "src_port": 61351, "dest_port": 53}}');
INSERT INTO alerts VALUES(139,1772972371.418720961,'{"timestamp": "2026-03-08T13:19:31.418721+0100", "flow_id": 953970788366412, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 38465, "dest_ip": "185.254.126.122", "dest_port": 8000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:19:31.418721+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 38465, "dest_port": 8000}}');
INSERT INTO alerts VALUES(140,1772972371.418720961,'{"timestamp": "2026-03-08T13:19:31.418721+0100", "flow_id": 953970788366412, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 38465, "dest_ip": "185.254.126.122", "dest_port": 8000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:19:31.418721+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 38465, "dest_port": 8000}}');
INSERT INTO alerts VALUES(141,1772972415.026680946,'{"timestamp": "2026-03-08T13:20:15.026681+0100", "flow_id": 2084920358551976, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 45706, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:20:15.026681+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 45706, "dest_port": 80}}');
INSERT INTO alerts VALUES(142,1772972522.197484971,'{"timestamp": "2026-03-08T13:22:02.197485+0100", "flow_id": 566718833651455, "event_type": "alert", "src_ip": "64.62.156.101", "src_port": 48932, "dest_ip": "185.254.126.122", "dest_port": 25, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:22:02.197485+0100", "src_ip": "64.62.156.101", "dest_ip": "185.254.126.122", "src_port": 48932, "dest_port": 25}}');
INSERT INTO alerts VALUES(143,1772972622.730004072,'{"timestamp": "2026-03-08T13:23:42.730004+0100", "flow_id": 1727971726173054, "event_type": "alert", "src_ip": "112.135.170.137", "src_port": 46251, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:23:42.730004+0100", "src_ip": "112.135.170.137", "dest_ip": "185.254.126.122", "src_port": 46251, "dest_port": 1433}}');
INSERT INTO alerts VALUES(144,1772972639.537672042,'{"timestamp": "2026-03-08T13:23:59.537672+0100", "flow_id": 2027810090184418, "event_type": "alert", "src_ip": "64.62.197.82", "src_port": 48425, "dest_ip": "185.254.126.122", "dest_port": 4840, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:23:59.537672+0100", "src_ip": "64.62.197.82", "dest_ip": "185.254.126.122", "src_port": 48425, "dest_port": 4840}}');
INSERT INTO alerts VALUES(145,1772972652.14081812,'{"timestamp": "2026-03-08T13:24:12.140818+0100", "flow_id": 1167760385250494, "event_type": "alert", "src_ip": "64.89.163.241", "src_port": 49084, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:24:12.140818+0100", "src_ip": "64.89.163.241", "dest_ip": "185.254.126.122", "src_port": 49084, "dest_port": 3000}}');
INSERT INTO alerts VALUES(146,1772972696.847150087,'{"timestamp": "2026-03-08T13:24:56.847150+0100", "flow_id": 260782663552275, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 32779, "dest_ip": "185.254.126.122", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:24:56.847150+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 32779, "dest_port": 3001}}');
INSERT INTO alerts VALUES(147,1772972772.148148059,'{"timestamp": "2026-03-08T13:26:12.148148+0100", "flow_id": 1199241648899954, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 1443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:26:12.148148+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 1443}}');
INSERT INTO alerts VALUES(148,1772972772.148148059,'{"timestamp": "2026-03-08T13:26:12.148148+0100", "flow_id": 1199241648899954, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 1443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:26:12.148148+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 1443}}');
INSERT INTO alerts VALUES(149,1772972781.278279067,'{"timestamp": "2026-03-08T13:26:21.278279+0100", "flow_id": 1476675263218085, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 57816, "dest_ip": "185.254.126.122", "dest_port": 32123, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:26:21.278279+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 57816, "dest_port": 32123}}');
INSERT INTO alerts VALUES(150,1772972799.567433119,'{"timestamp": "2026-03-08T13:26:39.567433+0100", "flow_id": 2155634950020812, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 44493, "dest_ip": "185.254.126.122", "dest_port": 7637, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:26:39.567433+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 44493, "dest_port": 7637}}');
INSERT INTO alerts VALUES(151,1772972807.564919949,'{"timestamp": "2026-03-08T13:26:47.564920+0100", "flow_id": 2144839997270736, "event_type": "alert", "src_ip": "204.76.203.30", "src_port": 49757, "dest_ip": "185.254.126.122", "dest_port": 8443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:26:47.564920+0100", "src_ip": "204.76.203.30", "dest_ip": "185.254.126.122", "src_port": 49757, "dest_port": 8443}}');
INSERT INTO alerts VALUES(152,1772972807.564919949,'{"timestamp": "2026-03-08T13:26:47.564920+0100", "flow_id": 2144839997270736, "event_type": "alert", "src_ip": "204.76.203.30", "src_port": 49757, "dest_ip": "185.254.126.122", "dest_port": 8443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:26:47.564920+0100", "src_ip": "204.76.203.30", "dest_ip": "185.254.126.122", "src_port": 49757, "dest_port": 8443}}');
INSERT INTO alerts VALUES(153,1772972822.955254077,'{"timestamp": "2026-03-08T13:27:02.955254+0100", "flow_id": 1850986419358875, "event_type": "alert", "src_ip": "192.168.2.22", "src_port": 54928, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2063117, "rev": 1, "signature": "ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_and_Server"], "confidence": ["Medium"], "created_at": ["2025_06_20"], "deployment": ["Perimeter"], "mitre_tactic_id": ["TA0011"], "mitre_tactic_name": ["Command_And_Control"], "mitre_technique_id": ["T1102"], "mitre_technique_name": ["Web_Service"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "updated_at": ["2025_06_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 16799, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "pinpoll-tracking-live-windows.azurewebsites.net", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T13:27:02.955254+0100", "src_ip": "192.168.2.22", "dest_ip": "192.168.2.1", "src_port": 54928, "dest_port": 53}}');
INSERT INTO alerts VALUES(154,1772972822.955574035,'{"timestamp": "2026-03-08T13:27:02.955574+0100", "flow_id": 1852359553329611, "event_type": "alert", "src_ip": "192.168.2.22", "src_port": 53092, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2063117, "rev": 1, "signature": "ET INFO Abused Hosting Domain in DNS Lookup (azurewebsites .net)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_and_Server"], "confidence": ["Medium"], "created_at": ["2025_06_20"], "deployment": ["Perimeter"], "mitre_tactic_id": ["TA0011"], "mitre_tactic_name": ["Command_And_Control"], "mitre_technique_id": ["T1102"], "mitre_technique_name": ["Web_Service"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "updated_at": ["2025_06_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 3910, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "pinpoll-tracking-live-windows.azurewebsites.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T13:27:02.955574+0100", "src_ip": "192.168.2.22", "dest_ip": "192.168.2.1", "src_port": 53092, "dest_port": 53}}');
INSERT INTO alerts VALUES(155,1772972836.023840905,'{"timestamp": "2026-03-08T13:27:16.023841+0100", "flow_id": 1228297511704843, "event_type": "alert", "src_ip": "167.94.138.107", "src_port": 26282, "dest_ip": "185.254.126.122", "dest_port": 5313, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:27:16.023841+0100", "src_ip": "167.94.138.107", "dest_ip": "185.254.126.122", "src_port": 26282, "dest_port": 5313}}');
INSERT INTO alerts VALUES(156,1772972840.957405091,'{"timestamp": "2026-03-08T13:27:20.957405+0100", "flow_id": 171377207655195, "event_type": "alert", "src_ip": "176.65.139.41", "src_port": 50001, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:27:20.957405+0100", "src_ip": "176.65.139.41", "dest_ip": "185.254.126.122", "src_port": 50001, "dest_port": 3000}}');
INSERT INTO alerts VALUES(157,1772972852.182192088,'{"timestamp": "2026-03-08T13:27:32.182192+0100", "flow_id": 1345462094921172, "event_type": "alert", "src_ip": "178.20.210.152", "src_port": 50165, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:27:32.182192+0100", "src_ip": "178.20.210.152", "dest_ip": "185.254.126.122", "src_port": 50165, "dest_port": 22}}');
INSERT INTO alerts VALUES(158,1772972921.076790094,'{"timestamp": "2026-03-08T13:28:41.076790+0100", "flow_id": 329810678400911, "event_type": "alert", "src_ip": "64.62.156.64", "src_port": 42820, "dest_ip": "185.254.126.122", "dest_port": 830, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:28:41.076790+0100", "src_ip": "64.62.156.64", "dest_ip": "185.254.126.122", "src_port": 42820, "dest_port": 830}}');
INSERT INTO alerts VALUES(159,1772972943.525029897,'{"timestamp": "2026-03-08T13:29:03.525030+0100", "flow_id": 1973514659879785, "event_type": "alert", "src_ip": "65.49.1.141", "src_port": 58198, "dest_ip": "185.254.126.122", "dest_port": 4118, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:29:03.525030+0100", "src_ip": "65.49.1.141", "dest_ip": "185.254.126.122", "src_port": 58198, "dest_port": 4118}}');
INSERT INTO alerts VALUES(160,1772973030.468720912,'{"timestamp": "2026-03-08T13:30:30.468721+0100", "flow_id": 1731668453095284, "event_type": "alert", "src_ip": "165.154.227.162", "src_port": 36383, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400029, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 30", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:30:30.468721+0100", "src_ip": "165.154.227.162", "dest_ip": "185.254.126.122", "src_port": 36383, "dest_port": 443}}');
INSERT INTO alerts VALUES(161,1772973030.468720912,'{"timestamp": "2026-03-08T13:30:30.468721+0100", "flow_id": 1731668453095284, "event_type": "alert", "src_ip": "165.154.227.162", "src_port": 36383, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500014, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:30:30.468721+0100", "src_ip": "165.154.227.162", "dest_ip": "185.254.126.122", "src_port": 36383, "dest_port": 443}}');
INSERT INTO alerts VALUES(162,1772973095.63487506,'{"timestamp": "2026-03-08T13:31:35.634875+0100", "flow_id": 2163818491247111, "event_type": "alert", "src_ip": "176.65.139.45", "src_port": 50217, "dest_ip": "185.254.126.122", "dest_port": 6036, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:31:35.634875+0100", "src_ip": "176.65.139.45", "dest_ip": "185.254.126.122", "src_port": 50217, "dest_port": 6036}}');
INSERT INTO alerts VALUES(163,1772973141.071481943,'{"timestamp": "2026-03-08T13:32:21.071482+0100", "flow_id": 1432913709182443, "event_type": "alert", "src_ip": "87.121.84.67", "src_port": 46227, "dest_ip": "185.254.126.122", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:32:21.071482+0100", "src_ip": "87.121.84.67", "dest_ip": "185.254.126.122", "src_port": 46227, "dest_port": 5900}}');
INSERT INTO alerts VALUES(164,1772973181.837021113,'{"timestamp": "2026-03-08T13:33:01.837021+0100", "flow_id": 1624653500932311, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 3443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:33:01.837021+0100", "src_ip": "185.156.73.86", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 3443}}');
INSERT INTO alerts VALUES(165,1772973212.475070954,'{"timestamp": "2026-03-08T13:33:32.475071+0100", "flow_id": 1195989794777632, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 17336, "dest_ip": "185.254.126.122", "dest_port": 15214, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:33:32.475071+0100", "src_ip": "167.94.146.42", "dest_ip": "185.254.126.122", "src_port": 17336, "dest_port": 15214}}');
INSERT INTO alerts VALUES(166,1772973431.019588947,'{"timestamp": "2026-03-08T13:37:11.019589+0100", "flow_id": 2054463024900712, "event_type": "alert", "src_ip": "193.163.125.9", "src_port": 55256, "dest_ip": "185.254.126.122", "dest_port": 554, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:37:11.019589+0100", "src_ip": "193.163.125.9", "dest_ip": "185.254.126.122", "src_port": 55256, "dest_port": 554}}');
INSERT INTO alerts VALUES(167,1772973470.337503911,'{"timestamp": "2026-03-08T13:37:50.337504+0100", "flow_id": 1731046161389373, "event_type": "alert", "src_ip": "65.49.1.131", "src_port": 45743, "dest_ip": "185.254.126.122", "dest_port": 11211, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:37:50.337504+0100", "src_ip": "65.49.1.131", "dest_ip": "185.254.126.122", "src_port": 45743, "dest_port": 11211}}');
INSERT INTO alerts VALUES(168,1772973474.422059059,'{"timestamp": "2026-03-08T13:37:54.422059+0100", "flow_id": 686830381029697, "event_type": "alert", "src_ip": "64.62.156.149", "src_port": 43921, "dest_ip": "185.254.126.122", "dest_port": 6379, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:37:54.422059+0100", "src_ip": "64.62.156.149", "dest_ip": "185.254.126.122", "src_port": 43921, "dest_port": 6379}}');
INSERT INTO alerts VALUES(169,1772973496.64595604,'{"timestamp": "2026-03-08T13:38:16.645956+0100", "flow_id": 241085918363985, "event_type": "alert", "src_ip": "167.94.146.34", "src_port": 5318, "dest_ip": "185.254.126.122", "dest_port": 33551, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:38:16.645956+0100", "src_ip": "167.94.146.34", "dest_ip": "185.254.126.122", "src_port": 5318, "dest_port": 33551}}');
INSERT INTO alerts VALUES(170,1772973544.524960995,'{"timestamp": "2026-03-08T13:39:04.524961+0100", "flow_id": 2892533476583, "event_type": "alert", "src_ip": "167.94.146.39", "src_port": 14487, "dest_ip": "185.254.126.122", "dest_port": 11947, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:39:04.524961+0100", "src_ip": "167.94.146.39", "dest_ip": "185.254.126.122", "src_port": 14487, "dest_port": 11947}}');
INSERT INTO alerts VALUES(171,1772973582.314892053,'{"timestamp": "2026-03-08T13:39:42.314892+0100", "flow_id": 1915400937329382, "event_type": "alert", "src_ip": "65.49.1.172", "src_port": 54651, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:39:42.314892+0100", "src_ip": "65.49.1.172", "dest_ip": "185.254.126.122", "src_port": 54651, "dest_port": 22}}');
INSERT INTO alerts VALUES(172,1772973588.780414105,'{"timestamp": "2026-03-08T13:39:48.780414+0100", "flow_id": 1381530166910618, "event_type": "alert", "src_ip": "64.95.96.69", "src_port": 5217, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 435, "bytes_toclient": 0, "start": "2026-03-08T13:39:48.780414+0100", "src_ip": "64.95.96.69", "dest_ip": "185.254.126.122", "src_port": 5217, "dest_port": 5060}}');
INSERT INTO alerts VALUES(173,1772973588.780414105,'{"timestamp": "2026-03-08T13:39:48.780414+0100", "flow_id": 1381530166910618, "event_type": "alert", "src_ip": "64.95.96.69", "src_port": 5217, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 435, "bytes_toclient": 0, "start": "2026-03-08T13:39:48.780414+0100", "src_ip": "64.95.96.69", "dest_ip": "185.254.126.122", "src_port": 5217, "dest_port": 5060}}');
INSERT INTO alerts VALUES(174,1772973619.898673058,'{"timestamp": "2026-03-08T13:40:19.898673+0100", "flow_id": 1045023732564279, "event_type": "alert", "src_ip": "193.163.125.37", "src_port": 44244, "dest_ip": "185.254.126.122", "dest_port": 33060, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:40:19.898673+0100", "src_ip": "193.163.125.37", "dest_ip": "185.254.126.122", "src_port": 44244, "dest_port": 33060}}');
INSERT INTO alerts VALUES(175,1772973628.433710098,'{"timestamp": "2026-03-08T13:40:28.433710+0100", "flow_id": 1299822278433029, "event_type": "alert", "src_ip": "2.57.122.238", "src_port": 60735, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2500026, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:40:28.433710+0100", "src_ip": "2.57.122.238", "dest_ip": "185.254.126.122", "src_port": 60735, "dest_port": 22}}');
INSERT INTO alerts VALUES(176,1772973643.356739045,'{"timestamp": "2026-03-08T13:40:43.356739+0100", "flow_id": 969235053572635, "event_type": "alert", "src_ip": "147.185.132.250", "src_port": 52368, "dest_ip": "185.254.126.122", "dest_port": 51202, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:40:43.356739+0100", "src_ip": "147.185.132.250", "dest_ip": "185.254.126.122", "src_port": 52368, "dest_port": 51202}}');
INSERT INTO alerts VALUES(177,1772973692.629972935,'{"timestamp": "2026-03-08T13:41:32.629973+0100", "flow_id": 1298342652442280, "event_type": "alert", "src_ip": "167.94.146.74", "src_port": 3381, "dest_ip": "185.254.126.122", "dest_port": 24989, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:41:32.629973+0100", "src_ip": "167.94.146.74", "dest_ip": "185.254.126.122", "src_port": 3381, "dest_port": 24989}}');
INSERT INTO alerts VALUES(178,1772973727.890037059,'{"timestamp": "2026-03-08T13:42:07.890037+0100", "flow_id": 2133834012486163, "event_type": "alert", "src_ip": "167.94.146.41", "src_port": 17847, "dest_ip": "185.254.126.122", "dest_port": 20606, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:42:07.890037+0100", "src_ip": "167.94.146.41", "dest_ip": "185.254.126.122", "src_port": 17847, "dest_port": 20606}}');
INSERT INTO alerts VALUES(179,1772973737.667052985,'{"timestamp": "2026-03-08T13:42:17.667053+0100", "flow_id": 331699248882025, "event_type": "alert", "src_ip": "64.62.156.50", "src_port": 36517, "dest_ip": "185.254.126.122", "dest_port": 1200, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:42:17.667053+0100", "src_ip": "64.62.156.50", "dest_ip": "185.254.126.122", "src_port": 36517, "dest_port": 1200}}');
INSERT INTO alerts VALUES(180,1772973788.315941096,'{"timestamp": "2026-03-08T13:43:08.315941+0100", "flow_id": 1356956268183854, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 43028, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:43:08.315941+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 43028, "dest_port": 23}}');
INSERT INTO alerts VALUES(181,1772973788.315941096,'{"timestamp": "2026-03-08T13:43:08.315941+0100", "flow_id": 1356956268183854, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 43028, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:43:08.315941+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 43028, "dest_port": 23}}');
INSERT INTO alerts VALUES(182,1772973823.641407967,'{"timestamp": "2026-03-08T13:43:43.641408+0100", "flow_id": 2191880050720735, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 52645, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:43:43.641408+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 52645, "dest_port": 3389}}');
INSERT INTO alerts VALUES(183,1772973823.641407967,'{"timestamp": "2026-03-08T13:43:43.641408+0100", "flow_id": 2191880050720735, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 52645, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:43:43.641408+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 52645, "dest_port": 3389}}');
INSERT INTO alerts VALUES(184,1772973829.991050959,'{"timestamp": "2026-03-08T13:43:49.991051+0100", "flow_id": 1441783460423857, "event_type": "alert", "src_ip": "64.89.163.81", "src_port": 53715, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:43:49.991051+0100", "src_ip": "64.89.163.81", "dest_ip": "185.254.126.122", "src_port": 53715, "dest_port": 5432}}');
INSERT INTO alerts VALUES(185,1772973829.991050959,'{"timestamp": "2026-03-08T13:43:49.991051+0100", "flow_id": 1441783460423857, "event_type": "alert", "src_ip": "64.89.163.81", "src_port": 53715, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:43:49.991051+0100", "src_ip": "64.89.163.81", "dest_ip": "185.254.126.122", "src_port": 53715, "dest_port": 5432}}');
INSERT INTO alerts VALUES(186,1772973839.052125931,'{"timestamp": "2026-03-08T13:43:59.052126+0100", "flow_id": 2194205026372439, "event_type": "alert", "src_ip": "64.62.197.198", "src_port": 34898, "dest_ip": "185.254.126.122", "dest_port": 63256, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:43:59.052126+0100", "src_ip": "64.62.197.198", "dest_ip": "185.254.126.122", "src_port": 34898, "dest_port": 63256}}');
INSERT INTO alerts VALUES(187,1772973882.007618904,'{"timestamp": "2026-03-08T13:44:42.007619+0100", "flow_id": 595677443648176, "event_type": "alert", "src_ip": "64.62.156.76", "src_port": 56747, "dest_ip": "185.254.126.122", "dest_port": 1801, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:44:42.007619+0100", "src_ip": "64.62.156.76", "dest_ip": "185.254.126.122", "src_port": 56747, "dest_port": 1801}}');
INSERT INTO alerts VALUES(188,1772973930.36431694,'{"timestamp": "2026-03-08T13:45:30.364317+0100", "flow_id": 720308272947799, "event_type": "alert", "src_ip": "40.124.172.38", "src_port": 40391, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-08T13:45:30.364317+0100", "src_ip": "40.124.172.38", "dest_ip": "185.254.126.122", "src_port": 40391, "dest_port": 161}}');
INSERT INTO alerts VALUES(189,1772973951.974888087,'{"timestamp": "2026-03-08T13:45:51.974888+0100", "flow_id": 2216787566896844, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 48482, "dest_ip": "185.254.126.122", "dest_port": 3022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:45:51.974888+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 48482, "dest_port": 3022}}');
INSERT INTO alerts VALUES(190,1772973951.974888087,'{"timestamp": "2026-03-08T13:45:51.974888+0100", "flow_id": 2216787566896844, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 48482, "dest_ip": "185.254.126.122", "dest_port": 3022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:45:51.974888+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 48482, "dest_port": 3022}}');
INSERT INTO alerts VALUES(191,1772973961.542383909,'{"timestamp": "2026-03-08T13:46:01.542384+0100", "flow_id": 359199473417358, "event_type": "alert", "src_ip": "185.242.3.240", "src_port": 52569, "dest_ip": "185.254.126.122", "dest_port": 17025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:46:01.542384+0100", "src_ip": "185.242.3.240", "dest_ip": "185.254.126.122", "src_port": 52569, "dest_port": 17025}}');
INSERT INTO alerts VALUES(192,1772974022.320754052,'{"timestamp": "2026-03-08T13:47:02.320754+0100", "flow_id": 1940577973905515, "event_type": "alert", "src_ip": "193.163.125.34", "src_port": 57725, "dest_ip": "185.254.126.122", "dest_port": 10190, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:47:02.320754+0100", "src_ip": "193.163.125.34", "dest_ip": "185.254.126.122", "src_port": 57725, "dest_port": 10190}}');
INSERT INTO alerts VALUES(193,1772974023.271893979,'{"timestamp": "2026-03-08T13:47:03.271894+0100", "flow_id": 2012204121232118, "event_type": "alert", "src_ip": "65.49.1.64", "src_port": 6353, "dest_ip": "185.254.126.122", "dest_port": 5351, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 30, "bytes_toclient": 0, "start": "2026-03-08T13:47:03.271894+0100", "src_ip": "65.49.1.64", "dest_ip": "185.254.126.122", "src_port": 6353, "dest_port": 5351}}');
INSERT INTO alerts VALUES(194,1772974090.970803022,'{"timestamp": "2026-03-08T13:48:10.970803+0100", "flow_id": 791869847134237, "event_type": "alert", "src_ip": "64.62.156.160", "src_port": 45848, "dest_ip": "185.254.126.122", "dest_port": 2002, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:48:10.970803+0100", "src_ip": "64.62.156.160", "dest_ip": "185.254.126.122", "src_port": 45848, "dest_port": 2002}}');
INSERT INTO alerts VALUES(195,1772974129.59674406,'{"timestamp": "2026-03-08T13:48:49.596744+0100", "flow_id": 311198089084528, "event_type": "alert", "src_ip": "65.49.1.113", "src_port": 33483, "dest_ip": "185.254.126.122", "dest_port": 7000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:48:49.596744+0100", "src_ip": "65.49.1.113", "dest_ip": "185.254.126.122", "src_port": 33483, "dest_port": 7000}}');
INSERT INTO alerts VALUES(196,1772974188.669056892,'{"timestamp": "2026-03-08T13:49:48.669057+0100", "flow_id": 1184730860365608, "event_type": "alert", "src_ip": "147.185.132.245", "src_port": 52219, "dest_ip": "185.254.126.122", "dest_port": 49168, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:49:48.669057+0100", "src_ip": "147.185.132.245", "dest_ip": "185.254.126.122", "src_port": 52219, "dest_port": 49168}}');
INSERT INTO alerts VALUES(197,1772974195.274682045,'{"timestamp": "2026-03-08T13:49:55.274682+0100", "flow_id": 898275563411791, "event_type": "alert", "src_ip": "185.196.8.218", "src_port": 47348, "dest_ip": "185.254.126.122", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:49:55.274682+0100", "src_ip": "185.196.8.218", "dest_ip": "185.254.126.122", "src_port": 47348, "dest_port": 5900}}');
INSERT INTO alerts VALUES(198,1772974421.832417012,'{"timestamp": "2026-03-08T13:53:41.832417+0100", "flow_id": 1604883136656991, "event_type": "alert", "src_ip": "102.213.28.195", "src_port": 43392, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:53:41.832417+0100", "src_ip": "102.213.28.195", "dest_ip": "185.254.126.122", "src_port": 43392, "dest_port": 1433}}');
INSERT INTO alerts VALUES(199,1772974527.593869924,'{"timestamp": "2026-03-08T13:55:27.593870+0100", "flow_id": 1987706209604265, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 44392, "dest_ip": "185.254.126.122", "dest_port": 3897, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:55:27.593870+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 44392, "dest_port": 3897}}');
INSERT INTO alerts VALUES(200,1772974527.593869924,'{"timestamp": "2026-03-08T13:55:27.593870+0100", "flow_id": 1987706209604265, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 44392, "dest_ip": "185.254.126.122", "dest_port": 3897, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T13:55:27.593870+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 44392, "dest_port": 3897}}');
INSERT INTO alerts VALUES(201,1772974621.664828063,'{"timestamp": "2026-03-08T13:57:01.664828+0100", "flow_id": 1448039922556477, "event_type": "alert", "src_ip": "193.163.125.26", "src_port": 57034, "dest_ip": "185.254.126.122", "dest_port": 7103, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:57:01.664828+0100", "src_ip": "193.163.125.26", "dest_ip": "185.254.126.122", "src_port": 57034, "dest_port": 7103}}');
INSERT INTO alerts VALUES(202,1772974631.898323059,'{"timestamp": "2026-03-08T13:57:11.898323+0100", "flow_id": 2169421589848876, "event_type": "alert", "src_ip": "65.49.1.156", "src_port": 54364, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:57:11.898323+0100", "src_ip": "65.49.1.156", "dest_ip": "185.254.126.122", "src_port": 54364, "dest_port": 389}}');
INSERT INTO alerts VALUES(203,1772974638.816272974,'{"timestamp": "2026-03-08T13:57:18.816273+0100", "flow_id": 1817019493769203, "event_type": "alert", "src_ip": "167.94.138.140", "src_port": 19003, "dest_ip": "185.254.126.122", "dest_port": 830, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T13:57:18.816273+0100", "src_ip": "167.94.138.140", "dest_ip": "185.254.126.122", "src_port": 19003, "dest_port": 830}}');
INSERT INTO alerts VALUES(204,1772974734.892060995,'{"timestamp": "2026-03-08T13:58:54.892061+0100", "flow_id": 1861048654623477, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 14577, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:58:54.892061+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 14577}}');
INSERT INTO alerts VALUES(205,1772974757.098740101,'{"timestamp": "2026-03-08T13:59:17.098740+0100", "flow_id": 1549985809622479, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 44065, "dest_ip": "185.254.126.122", "dest_port": 1916, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T13:59:17.098740+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 44065, "dest_port": 1916}}');
INSERT INTO alerts VALUES(206,1772974784.395139932,'{"timestamp": "2026-03-08T13:59:44.395140+0100", "flow_id": 8267483913007, "event_type": "alert", "src_ip": "193.163.125.4", "src_port": 45339, "dest_ip": "185.254.126.122", "dest_port": 139, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T13:59:44.395140+0100", "src_ip": "193.163.125.4", "dest_ip": "185.254.126.122", "src_port": 45339, "dest_port": 139}}');
INSERT INTO alerts VALUES(207,1772974792.553770065,'{"timestamp": "2026-03-08T13:59:52.553770+0100", "flow_id": 126624924063193, "event_type": "alert", "src_ip": "51.38.211.50", "src_port": 5104, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 441, "bytes_toclient": 0, "start": "2026-03-08T13:59:52.553770+0100", "src_ip": "51.38.211.50", "dest_ip": "185.254.126.122", "src_port": 5104, "dest_port": 5060}}');
INSERT INTO alerts VALUES(208,1772974792.553770065,'{"timestamp": "2026-03-08T13:59:52.553770+0100", "flow_id": 126624924063193, "event_type": "alert", "src_ip": "51.38.211.50", "src_port": 5104, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 441, "bytes_toclient": 0, "start": "2026-03-08T13:59:52.553770+0100", "src_ip": "51.38.211.50", "dest_ip": "185.254.126.122", "src_port": 5104, "dest_port": 5060}}');
INSERT INTO alerts VALUES(209,1772974827.887116909,'{"timestamp": "2026-03-08T14:00:27.887117+0100", "flow_id": 995392744993017, "event_type": "alert", "src_ip": "64.62.197.199", "src_port": 52265, "dest_ip": "185.254.126.122", "dest_port": 789, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:00:27.887117+0100", "src_ip": "64.62.197.199", "dest_ip": "185.254.126.122", "src_port": 52265, "dest_port": 789}}');
INSERT INTO alerts VALUES(210,1772974976.283885956,'{"timestamp": "2026-03-08T14:02:56.283886+0100", "flow_id": 93382320489786, "event_type": "alert", "src_ip": "64.62.197.221", "src_port": 46531, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:02:56.283886+0100", "src_ip": "64.62.197.221", "dest_ip": "185.254.126.122", "src_port": 46531, "dest_port": 3389}}');
INSERT INTO alerts VALUES(211,1772975137.527179957,'{"timestamp": "2026-03-08T14:05:37.527180+0100", "flow_id": 293896745331994, "event_type": "alert", "src_ip": "167.94.138.157", "src_port": 15710, "dest_ip": "185.254.126.122", "dest_port": 8008, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:05:37.527180+0100", "src_ip": "167.94.138.157", "dest_ip": "185.254.126.122", "src_port": 15710, "dest_port": 8008}}');
INSERT INTO alerts VALUES(212,1772975140.774056912,'{"timestamp": "2026-03-08T14:05:40.774057+0100", "flow_id": 1354226936202242, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:05:40.774057+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3433}}');
INSERT INTO alerts VALUES(213,1772975154.949739934,'{"timestamp": "2026-03-08T14:05:54.949740+0100", "flow_id": 701403291115170, "event_type": "alert", "src_ip": "87.121.84.35", "src_port": 60001, "dest_ip": "185.254.126.122", "dest_port": 22123, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:05:54.949740+0100", "src_ip": "87.121.84.35", "dest_ip": "185.254.126.122", "src_port": 60001, "dest_port": 22123}}');
INSERT INTO alerts VALUES(214,1772975165.684034109,'{"timestamp": "2026-03-08T14:06:05.684034+0100", "flow_id": 1530531227498072, "event_type": "alert", "src_ip": "64.89.161.182", "src_port": 46029, "dest_ip": "185.254.126.122", "dest_port": 61080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T14:06:05.684034+0100", "src_ip": "64.89.161.182", "dest_ip": "185.254.126.122", "src_port": 46029, "dest_port": 61080}}');
INSERT INTO alerts VALUES(215,1772975214.755250931,'{"timestamp": "2026-03-08T14:06:54.755251+0100", "flow_id": 1836405428198177, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 51984, "dest_ip": "185.254.126.122", "dest_port": 2525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:06:54.755251+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 51984, "dest_port": 2525}}');
INSERT INTO alerts VALUES(216,1772975221.367921114,'{"timestamp": "2026-03-08T14:07:01.367921+0100", "flow_id": 1580208902948040, "event_type": "alert", "src_ip": "192.168.2.20", "src_port": 59828, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2057745, "rev": 1, "signature": "ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_11_20"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_11_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 14505, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "kaufradar-teaser.pages.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 72, "bytes_toclient": 0, "start": "2026-03-08T14:07:01.367921+0100", "src_ip": "192.168.2.20", "dest_ip": "192.168.2.1", "src_port": 59828, "dest_port": 53}}');
INSERT INTO alerts VALUES(217,1772975223.293417931,'{"timestamp": "2026-03-08T14:07:03.293418+0100", "flow_id": 2104648963315777, "event_type": "alert", "src_ip": "147.185.132.56", "src_port": 51517, "dest_ip": "185.254.126.122", "dest_port": 47004, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:07:03.293418+0100", "src_ip": "147.185.132.56", "dest_ip": "185.254.126.122", "src_port": 51517, "dest_port": 47004}}');
INSERT INTO alerts VALUES(218,1772975263.982474088,'{"timestamp": "2026-03-08T14:07:43.982474+0100", "flow_id": 2249371001362020, "event_type": "alert", "src_ip": "167.94.138.147", "src_port": 35527, "dest_ip": "185.254.126.122", "dest_port": 47809, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 45, "bytes_toclient": 0, "start": "2026-03-08T14:07:43.982474+0100", "src_ip": "167.94.138.147", "dest_ip": "185.254.126.122", "src_port": 35527, "dest_port": 47809}}');
INSERT INTO alerts VALUES(219,1772975265.34902811,'{"timestamp": "2026-03-08T14:07:45.349028+0100", "flow_id": 373164906832185, "event_type": "alert", "src_ip": "193.163.125.30", "src_port": 53232, "dest_ip": "185.254.126.122", "dest_port": 50004, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:07:45.349028+0100", "src_ip": "193.163.125.30", "dest_ip": "185.254.126.122", "src_port": 53232, "dest_port": 50004}}');
INSERT INTO alerts VALUES(220,1772975299.792582036,'{"timestamp": "2026-03-08T14:08:19.792582+0100", "flow_id": 870839898506859, "event_type": "alert", "src_ip": "181.214.147.43", "src_port": 43387, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400033, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 34", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:08:19.792582+0100", "src_ip": "181.214.147.43", "dest_ip": "185.254.126.122", "src_port": 43387, "dest_port": 80}}');
INSERT INTO alerts VALUES(221,1772975320.238785983,'{"timestamp": "2026-03-08T14:08:40.238786+0100", "flow_id": 181154653190122, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 44979, "dest_ip": "185.254.126.122", "dest_port": 26040, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:08:40.238786+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 44979, "dest_port": 26040}}');
INSERT INTO alerts VALUES(222,1772975340.78540206,'{"timestamp": "2026-03-08T14:09:00.785402+0100", "flow_id": 1402952326132448, "event_type": "alert", "src_ip": "87.121.84.85", "src_port": 45644, "dest_ip": "185.254.126.122", "dest_port": 2011, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:09:00.785402+0100", "src_ip": "87.121.84.85", "dest_ip": "185.254.126.122", "src_port": 45644, "dest_port": 2011}}');
INSERT INTO alerts VALUES(223,1772975485.243180036,'{"timestamp": "2026-03-08T14:11:25.243180+0100", "flow_id": 1607401251848786, "event_type": "alert", "src_ip": "64.62.156.70", "src_port": 56076, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 80, "bytes_toclient": 0, "start": "2026-03-08T14:11:25.243180+0100", "src_ip": "64.62.156.70", "dest_ip": "185.254.126.122", "src_port": 56076, "dest_port": 389}}');
INSERT INTO alerts VALUES(224,1772975571.847101927,'{"timestamp": "2026-03-08T14:12:51.847102+0100", "flow_id": 1105003646254402, "event_type": "alert", "src_ip": "193.163.125.23", "src_port": 48449, "dest_ip": "185.254.126.122", "dest_port": 135, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:12:51.847102+0100", "src_ip": "193.163.125.23", "dest_ip": "185.254.126.122", "src_port": 48449, "dest_port": 135}}');
INSERT INTO alerts VALUES(225,1772975623.74753189,'{"timestamp": "2026-03-08T14:13:43.747532+0100", "flow_id": 2084725983153193, "event_type": "alert", "src_ip": "147.185.132.160", "src_port": 54614, "dest_ip": "185.254.126.122", "dest_port": 47320, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:13:43.747532+0100", "src_ip": "147.185.132.160", "dest_ip": "185.254.126.122", "src_port": 54614, "dest_port": 47320}}');
INSERT INTO alerts VALUES(226,1772975783.735387087,'{"timestamp": "2026-03-08T14:16:23.735387+0100", "flow_id": 2032564759054825, "event_type": "alert", "src_ip": "193.163.125.19", "src_port": 44347, "dest_ip": "185.254.126.122", "dest_port": 5052, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:16:23.735387+0100", "src_ip": "193.163.125.19", "dest_ip": "185.254.126.122", "src_port": 44347, "dest_port": 5052}}');
INSERT INTO alerts VALUES(227,1772975806.25959897,'{"timestamp": "2026-03-08T14:16:46.259599+0100", "flow_id": 1959396805034725, "event_type": "alert", "src_ip": "193.32.162.142", "src_port": 55802, "dest_ip": "185.254.126.122", "dest_port": 40190, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:16:46.259599+0100", "src_ip": "193.32.162.142", "dest_ip": "185.254.126.122", "src_port": 55802, "dest_port": 40190}}');
INSERT INTO alerts VALUES(228,1772975868.314323903,'{"timestamp": "2026-03-08T14:17:48.314324+0100", "flow_id": 1350012979855452, "event_type": "alert", "src_ip": "147.185.132.164", "src_port": 52283, "dest_ip": "185.254.126.122", "dest_port": 37321, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:17:48.314324+0100", "src_ip": "147.185.132.164", "dest_ip": "185.254.126.122", "src_port": 52283, "dest_port": 37321}}');
INSERT INTO alerts VALUES(229,1772975913.3621099,'{"timestamp": "2026-03-08T14:18:33.362110+0100", "flow_id": 429350844378781, "event_type": "alert", "src_ip": "167.94.138.143", "src_port": 52285, "dest_ip": "185.254.126.122", "dest_port": 5349, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 150, "bytes_toclient": 0, "start": "2026-03-08T14:18:33.362110+0100", "src_ip": "167.94.138.143", "dest_ip": "185.254.126.122", "src_port": 52285, "dest_port": 5349}}');
INSERT INTO alerts VALUES(230,1772975924.410053968,'{"timestamp": "2026-03-08T14:18:44.410054+0100", "flow_id": 1198219233316296, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 49460, "dest_ip": "185.254.126.122", "dest_port": 50022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:18:44.410054+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 49460, "dest_port": 50022}}');
INSERT INTO alerts VALUES(231,1772975924.410053968,'{"timestamp": "2026-03-08T14:18:44.410054+0100", "flow_id": 1198219233316296, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 49460, "dest_ip": "185.254.126.122", "dest_port": 50022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:18:44.410054+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 49460, "dest_port": 50022}}');
INSERT INTO alerts VALUES(232,1772975946.425246,'{"timestamp": "2026-03-08T14:19:06.425246+0100", "flow_id": 700521355454167, "event_type": "alert", "src_ip": "40.160.34.88", "src_port": 46706, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2500028, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 15", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:19:06.425246+0100", "src_ip": "40.160.34.88", "dest_ip": "185.254.126.122", "src_port": 46706, "dest_port": 22}}');
INSERT INTO alerts VALUES(233,1772975998.562417984,'{"timestamp": "2026-03-08T14:19:58.562418+0100", "flow_id": 1852617234728918, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55296, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:19:58.562418+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 55296, "dest_port": 3389}}');
INSERT INTO alerts VALUES(234,1772975999.720503091,'{"timestamp": "2026-03-08T14:19:59.720503+0100", "flow_id": 2250112204786612, "event_type": "alert", "src_ip": "193.163.125.53", "src_port": 20400, "dest_ip": "185.254.126.122", "dest_port": 12346, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-08T14:19:59.720503+0100", "src_ip": "193.163.125.53", "dest_ip": "185.254.126.122", "src_port": 20400, "dest_port": 12346}}');
INSERT INTO alerts VALUES(235,1772976044.807852984,'{"timestamp": "2026-03-08T14:20:44.807853+0100", "flow_id": 1217904660873880, "event_type": "alert", "src_ip": "192.168.2.20", "src_port": 56841, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2057745, "rev": 1, "signature": "ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_11_20"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_11_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 39806, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "kaufradar-teaser.pages.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 72, "bytes_toclient": 0, "start": "2026-03-08T14:20:44.807853+0100", "src_ip": "192.168.2.20", "dest_ip": "192.168.2.1", "src_port": 56841, "dest_port": 53}}');
INSERT INTO alerts VALUES(236,1772976050.982892991,'{"timestamp": "2026-03-08T14:20:50.982893+0100", "flow_id": 843795587048910, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 53983, "dest_ip": "185.254.126.122", "dest_port": 30314, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:20:50.982893+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 53983, "dest_port": 30314}}');
INSERT INTO alerts VALUES(237,1772976073.724261999,'{"timestamp": "2026-03-08T14:21:13.724262+0100", "flow_id": 295933604250087, "event_type": "alert", "src_ip": "88.210.63.191", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44346, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:21:13.724262+0100", "src_ip": "88.210.63.191", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44346}}');
INSERT INTO alerts VALUES(238,1772976116.456006051,'{"timestamp": "2026-03-08T14:21:56.456006+0100", "flow_id": 1395583690010345, "event_type": "alert", "src_ip": "167.94.138.158", "src_port": 20725, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:21:56.456006+0100", "src_ip": "167.94.138.158", "dest_ip": "185.254.126.122", "src_port": 20725, "dest_port": 5432}}');
INSERT INTO alerts VALUES(239,1772976116.456006051,'{"timestamp": "2026-03-08T14:21:56.456006+0100", "flow_id": 1395583690010345, "event_type": "alert", "src_ip": "167.94.138.158", "src_port": 20725, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:21:56.456006+0100", "src_ip": "167.94.138.158", "dest_ip": "185.254.126.122", "src_port": 20725, "dest_port": 5432}}');
INSERT INTO alerts VALUES(240,1772976120.276458979,'{"timestamp": "2026-03-08T14:22:00.276459+0100", "flow_id": 61486045096029, "event_type": "alert", "src_ip": "66.132.153.149", "src_port": 22362, "dest_ip": "185.254.126.122", "dest_port": 3702, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 655, "bytes_toclient": 0, "start": "2026-03-08T14:22:00.276459+0100", "src_ip": "66.132.153.149", "dest_ip": "185.254.126.122", "src_port": 22362, "dest_port": 3702}}');
INSERT INTO alerts VALUES(241,1772976235.51304698,'{"timestamp": "2026-03-08T14:23:55.513047+0100", "flow_id": 1077623695247081, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 6087, "dest_ip": "185.254.126.122", "dest_port": 2135, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:23:55.513047+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 6087, "dest_port": 2135}}');
INSERT INTO alerts VALUES(242,1772976293.109487057,'{"timestamp": "2026-03-08T14:24:53.109487+0100", "flow_id": 1596145766071911, "event_type": "alert", "src_ip": "193.163.125.55", "src_port": 22144, "dest_ip": "185.254.126.122", "dest_port": 427, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 75, "bytes_toclient": 0, "start": "2026-03-08T14:24:53.109487+0100", "src_ip": "193.163.125.55", "dest_ip": "185.254.126.122", "src_port": 22144, "dest_port": 427}}');
INSERT INTO alerts VALUES(243,1772976308.540764094,'{"timestamp": "2026-03-08T14:25:08.540764+0100", "flow_id": 1196665475403879, "event_type": "alert", "src_ip": "147.185.132.142", "src_port": 52121, "dest_ip": "185.254.126.122", "dest_port": 49467, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:25:08.540764+0100", "src_ip": "147.185.132.142", "dest_ip": "185.254.126.122", "src_port": 52121, "dest_port": 49467}}');
INSERT INTO alerts VALUES(244,1772976318.810043097,'{"timestamp": "2026-03-08T14:25:18.810043+0100", "flow_id": 1790261935344446, "event_type": "alert", "src_ip": "193.163.125.21", "src_port": 37579, "dest_ip": "185.254.126.122", "dest_port": 7444, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:25:18.810043+0100", "src_ip": "193.163.125.21", "dest_ip": "185.254.126.122", "src_port": 37579, "dest_port": 7444}}');
INSERT INTO alerts VALUES(245,1772976321.865226985,'{"timestamp": "2026-03-08T14:25:21.865227+0100", "flow_id": 338424183228074, "event_type": "alert", "src_ip": "64.62.156.107", "src_port": 40182, "dest_ip": "185.254.126.122", "dest_port": 4786, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:25:21.865227+0100", "src_ip": "64.62.156.107", "dest_ip": "185.254.126.122", "src_port": 40182, "dest_port": 4786}}');
INSERT INTO alerts VALUES(246,1772976380.630831004,'{"timestamp": "2026-03-08T14:26:20.630831+0100", "flow_id": 1302027836661937, "event_type": "alert", "src_ip": "65.49.1.34", "src_port": 49895, "dest_ip": "185.254.126.122", "dest_port": 50075, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:26:20.630831+0100", "src_ip": "65.49.1.34", "dest_ip": "185.254.126.122", "src_port": 49895, "dest_port": 50075}}');
INSERT INTO alerts VALUES(247,1772976399.886068106,'{"timestamp": "2026-03-08T14:26:39.886068+0100", "flow_id": 2116783698364033, "event_type": "alert", "src_ip": "193.163.125.20", "src_port": 48530, "dest_ip": "185.254.126.122", "dest_port": 111, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:26:39.886068+0100", "src_ip": "193.163.125.20", "dest_ip": "185.254.126.122", "src_port": 48530, "dest_port": 111}}');
INSERT INTO alerts VALUES(248,1772976505.395400047,'{"timestamp": "2026-03-08T14:28:25.395400+0100", "flow_id": 290857235626246, "event_type": "alert", "src_ip": "185.156.73.180", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 666, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:28:25.395400+0100", "src_ip": "185.156.73.180", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 666}}');
INSERT INTO alerts VALUES(249,1772976543.955166102,'{"timestamp": "2026-03-08T14:29:03.955166+0100", "flow_id": 2132084681709813, "event_type": "alert", "src_ip": "64.62.156.20", "src_port": 39615, "dest_ip": "185.254.126.122", "dest_port": 212, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:29:03.955166+0100", "src_ip": "64.62.156.20", "dest_ip": "185.254.126.122", "src_port": 39615, "dest_port": 212}}');
INSERT INTO alerts VALUES(250,1772976571.801059008,'{"timestamp": "2026-03-08T14:29:31.801059+0100", "flow_id": 907248417813152, "event_type": "alert", "src_ip": "64.62.197.93", "src_port": 48207, "dest_ip": "185.254.126.122", "dest_port": 6161, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:29:31.801059+0100", "src_ip": "64.62.197.93", "dest_ip": "185.254.126.122", "src_port": 48207, "dest_port": 6161}}');
INSERT INTO alerts VALUES(251,1772976610.414431095,'{"timestamp": "2026-03-08T14:30:10.414431+0100", "flow_id": 654071762892043, "event_type": "alert", "src_ip": "65.49.1.207", "src_port": 42368, "dest_ip": "185.254.126.122", "dest_port": 135, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:30:10.414431+0100", "src_ip": "65.49.1.207", "dest_ip": "185.254.126.122", "src_port": 42368, "dest_port": 135}}');
INSERT INTO alerts VALUES(252,1772976658.338177919,'{"timestamp": "2026-03-08T14:30:58.338178+0100", "flow_id": 608040691409149, "event_type": "alert", "src_ip": "65.49.1.237", "src_port": 53312, "dest_ip": "185.254.126.122", "dest_port": 993, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:30:58.338178+0100", "src_ip": "65.49.1.237", "dest_ip": "185.254.126.122", "src_port": 53312, "dest_port": 993}}');
INSERT INTO alerts VALUES(253,1772976673.524997949,'{"timestamp": "2026-03-08T14:31:13.524998+0100", "flow_id": 284527817534552, "event_type": "alert", "src_ip": "147.185.132.170", "src_port": 54362, "dest_ip": "185.254.126.122", "dest_port": 1688, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:31:13.524998+0100", "src_ip": "147.185.132.170", "dest_ip": "185.254.126.122", "src_port": 54362, "dest_port": 1688}}');
INSERT INTO alerts VALUES(254,1772976694.443005085,'{"timestamp": "2026-03-08T14:31:34.443005+0100", "flow_id": 1902692197817503, "event_type": "alert", "src_ip": "65.49.1.210", "src_port": 54940, "dest_ip": "185.254.126.122", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:31:34.443005+0100", "src_ip": "65.49.1.210", "dest_ip": "185.254.126.122", "src_port": 54940, "dest_port": 17000}}');
INSERT INTO alerts VALUES(255,1772976704.1768291,'{"timestamp": "2026-03-08T14:31:44.176829+0100", "flow_id": 196528782679061, "event_type": "alert", "src_ip": "65.49.1.146", "src_port": 44718, "dest_ip": "185.254.126.122", "dest_port": 8873, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:31:44.176829+0100", "src_ip": "65.49.1.146", "dest_ip": "185.254.126.122", "src_port": 44718, "dest_port": 8873}}');
INSERT INTO alerts VALUES(256,1772976714.83255291,'{"timestamp": "2026-03-08T14:31:54.832553+0100", "flow_id": 761038257219682, "event_type": "alert", "src_ip": "64.62.156.229", "src_port": 35668, "dest_ip": "185.254.126.122", "dest_port": 6000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:31:54.832553+0100", "src_ip": "64.62.156.229", "dest_ip": "185.254.126.122", "src_port": 35668, "dest_port": 6000}}');
INSERT INTO alerts VALUES(257,1772976726.60194707,'{"timestamp": "2026-03-08T14:32:06.601947+0100", "flow_id": 1740921021944363, "event_type": "alert", "src_ip": "64.62.156.127", "src_port": 32781, "dest_ip": "185.254.126.122", "dest_port": 49665, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:32:06.601947+0100", "src_ip": "64.62.156.127", "dest_ip": "185.254.126.122", "src_port": 32781, "dest_port": 49665}}');
INSERT INTO alerts VALUES(258,1772976735.599164009,'{"timestamp": "2026-03-08T14:32:15.599164+0100", "flow_id": 2010440681685534, "event_type": "alert", "src_ip": "167.94.138.129", "src_port": 44038, "dest_ip": "185.254.126.122", "dest_port": 1194, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 42, "bytes_toclient": 0, "start": "2026-03-08T14:32:15.599164+0100", "src_ip": "167.94.138.129", "dest_ip": "185.254.126.122", "src_port": 44038, "dest_port": 1194}}');
INSERT INTO alerts VALUES(259,1772976738.309305906,'{"timestamp": "2026-03-08T14:32:18.309306+0100", "flow_id": 765511726626055, "event_type": "alert", "src_ip": "147.185.132.205", "src_port": 52049, "dest_ip": "185.254.126.122", "dest_port": 50921, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:32:18.309306+0100", "src_ip": "147.185.132.205", "dest_ip": "185.254.126.122", "src_port": 52049, "dest_port": 50921}}');
INSERT INTO alerts VALUES(260,1772976795.745842934,'{"timestamp": "2026-03-08T14:33:15.745843+0100", "flow_id": 951575417814810, "event_type": "alert", "src_ip": "64.62.197.180", "src_port": 40286, "dest_ip": "185.254.126.122", "dest_port": 5803, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:33:15.745843+0100", "src_ip": "64.62.197.180", "dest_ip": "185.254.126.122", "src_port": 40286, "dest_port": 5803}}');
INSERT INTO alerts VALUES(261,1772976874.44428897,'{"timestamp": "2026-03-08T14:34:34.444289+0100", "flow_id": 782307165606820, "event_type": "alert", "src_ip": "88.210.63.192", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44341, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:34:34.444289+0100", "src_ip": "88.210.63.192", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44341}}');
INSERT INTO alerts VALUES(262,1772976940.380983114,'{"timestamp": "2026-03-08T14:35:40.380983+0100", "flow_id": 1354836114410276, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 44177, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T14:35:40.380983+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 44177, "dest_port": 8080}}');
INSERT INTO alerts VALUES(263,1772976940.380983114,'{"timestamp": "2026-03-08T14:35:40.380983+0100", "flow_id": 1354836114410276, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 44177, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T14:35:40.380983+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 44177, "dest_port": 8080}}');
INSERT INTO alerts VALUES(264,1772976994.542766094,'{"timestamp": "2026-03-08T14:36:34.542766+0100", "flow_id": 642316289251841, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 56397, "dest_ip": "185.254.126.122", "dest_port": 10030, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:36:34.542766+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 56397, "dest_port": 10030}}');
INSERT INTO alerts VALUES(265,1772976994.542766094,'{"timestamp": "2026-03-08T14:36:34.542766+0100", "flow_id": 642316289251841, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 56397, "dest_ip": "185.254.126.122", "dest_port": 10030, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:36:34.542766+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 56397, "dest_port": 10030}}');
INSERT INTO alerts VALUES(266,1772977003.980624914,'{"timestamp": "2026-03-08T14:36:43.980625+0100", "flow_id": 1115529438221406, "event_type": "alert", "src_ip": "64.62.156.45", "src_port": 37707, "dest_ip": "185.254.126.122", "dest_port": 21, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:36:43.980625+0100", "src_ip": "64.62.156.45", "dest_ip": "185.254.126.122", "src_port": 37707, "dest_port": 21}}');
INSERT INTO alerts VALUES(267,1772977028.916932106,'{"timestamp": "2026-03-08T14:37:08.916932+0100", "flow_id": 1404918568163931, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 53812, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:37:08.916932+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 53812, "dest_port": 3389}}');
INSERT INTO alerts VALUES(268,1772977040.146516084,'{"timestamp": "2026-03-08T14:37:20.146516+0100", "flow_id": 66335159063691, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 26703, "dest_ip": "185.254.126.122", "dest_port": 28106, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:37:20.146516+0100", "src_ip": "167.94.146.35", "dest_ip": "185.254.126.122", "src_port": 26703, "dest_port": 28106}}');
INSERT INTO alerts VALUES(269,1772977052.007858991,'{"timestamp": "2026-03-08T14:37:32.007859+0100", "flow_id": 1159658200109061, "event_type": "alert", "src_ip": "45.156.87.50", "src_port": 53442, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:37:32.007859+0100", "src_ip": "45.156.87.50", "dest_ip": "185.254.126.122", "src_port": 53442, "dest_port": 23}}');
INSERT INTO alerts VALUES(270,1772977056.940897942,'{"timestamp": "2026-03-08T14:37:36.940898+0100", "flow_id": 100476886327177, "event_type": "alert", "src_ip": "65.49.1.129", "src_port": 55729, "dest_ip": "185.254.126.122", "dest_port": 5672, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:37:36.940898+0100", "src_ip": "65.49.1.129", "dest_ip": "185.254.126.122", "src_port": 55729, "dest_port": 5672}}');
INSERT INTO alerts VALUES(271,1772977060.931516886,'{"timestamp": "2026-03-08T14:37:40.931517+0100", "flow_id": 1186085421884307, "event_type": "alert", "src_ip": "64.62.197.60", "src_port": 46684, "dest_ip": "185.254.126.122", "dest_port": 44818, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:37:40.931517+0100", "src_ip": "64.62.197.60", "dest_ip": "185.254.126.122", "src_port": 46684, "dest_port": 44818}}');
INSERT INTO alerts VALUES(272,1772977114.180310965,'{"timestamp": "2026-03-08T14:38:34.180311+0100", "flow_id": 774431810500726, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 45706, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:38:34.180311+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 45706, "dest_port": 443}}');
INSERT INTO alerts VALUES(273,1772977144.908554077,'{"timestamp": "2026-03-08T14:39:04.908554+0100", "flow_id": 243035760034035, "event_type": "alert", "src_ip": "167.94.138.138", "src_port": 54868, "dest_ip": "185.254.126.122", "dest_port": 1311, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:39:04.908554+0100", "src_ip": "167.94.138.138", "dest_ip": "185.254.126.122", "src_port": 54868, "dest_port": 1311}}');
INSERT INTO alerts VALUES(274,1772977162.459465026,'{"timestamp": "2026-03-08T14:39:22.459465+0100", "flow_id": 566015522290740, "event_type": "alert", "src_ip": "193.163.125.14", "src_port": 44761, "dest_ip": "185.254.126.122", "dest_port": 20243, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:39:22.459465+0100", "src_ip": "193.163.125.14", "dest_ip": "185.254.126.122", "src_port": 44761, "dest_port": 20243}}');
INSERT INTO alerts VALUES(275,1772977213.662091971,'{"timestamp": "2026-03-08T14:40:13.662092+0100", "flow_id": 1436289439013923, "event_type": "alert", "src_ip": "167.94.146.34", "src_port": 50047, "dest_ip": "185.254.126.122", "dest_port": 40965, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:40:13.662092+0100", "src_ip": "167.94.146.34", "dest_ip": "185.254.126.122", "src_port": 50047, "dest_port": 40965}}');
INSERT INTO alerts VALUES(276,1772977308.700778962,'{"timestamp": "2026-03-08T14:41:48.700779+0100", "flow_id": 1320976130264721, "event_type": "alert", "src_ip": "91.196.152.60", "src_port": 48905, "dest_ip": "185.254.126.122", "dest_port": 666, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:41:48.700779+0100", "src_ip": "91.196.152.60", "dest_ip": "185.254.126.122", "src_port": 48905, "dest_port": 666}}');
INSERT INTO alerts VALUES(277,1772977350.017081975,'{"timestamp": "2026-03-08T14:42:30.017082+0100", "flow_id": 1762216513746088, "event_type": "alert", "src_ip": "176.65.149.45", "src_port": 43418, "dest_ip": "185.254.126.122", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:42:30.017082+0100", "src_ip": "176.65.149.45", "dest_ip": "185.254.126.122", "src_port": 43418, "dest_port": 8081}}');
INSERT INTO alerts VALUES(278,1772977457.0069561,'{"timestamp": "2026-03-08T14:44:17.006956+0100", "flow_id": 311353605634711, "event_type": "alert", "src_ip": "91.196.152.52", "src_port": 55732, "dest_ip": "185.254.126.122", "dest_port": 63210, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:44:17.006956+0100", "src_ip": "91.196.152.52", "dest_ip": "185.254.126.122", "src_port": 55732, "dest_port": 63210}}');
INSERT INTO alerts VALUES(279,1772977471.248222113,'{"timestamp": "2026-03-08T14:44:31.248222+0100", "flow_id": 2192007565483533, "event_type": "alert", "src_ip": "167.94.138.108", "src_port": 6344, "dest_ip": "185.254.126.122", "dest_port": 15167, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:44:31.248222+0100", "src_ip": "167.94.138.108", "dest_ip": "185.254.126.122", "src_port": 6344, "dest_port": 15167}}');
INSERT INTO alerts VALUES(280,1772977474.122344017,'{"timestamp": "2026-03-08T14:44:34.122344+0100", "flow_id": 806938616802784, "event_type": "alert", "src_ip": "64.62.156.226", "src_port": 33800, "dest_ip": "185.254.126.122", "dest_port": 5904, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:44:34.122344+0100", "src_ip": "64.62.156.226", "dest_ip": "185.254.126.122", "src_port": 33800, "dest_port": 5904}}');
INSERT INTO alerts VALUES(281,1772977508.366415977,'{"timestamp": "2026-03-08T14:45:08.366416+0100", "flow_id": 1292272911205355, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 22149, "dest_ip": "185.254.126.122", "dest_port": 14097, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:45:08.366416+0100", "src_ip": "167.94.146.38", "dest_ip": "185.254.126.122", "src_port": 22149, "dest_port": 14097}}');
INSERT INTO alerts VALUES(282,1772977620.483668088,'{"timestamp": "2026-03-08T14:47:00.483668+0100", "flow_id": 1232916084521345, "event_type": "alert", "src_ip": "64.89.163.154", "src_port": 57398, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:47:00.483668+0100", "src_ip": "64.89.163.154", "dest_ip": "185.254.126.122", "src_port": 57398, "dest_port": 3306}}');
INSERT INTO alerts VALUES(283,1772977620.483668088,'{"timestamp": "2026-03-08T14:47:00.483668+0100", "flow_id": 1232916084521345, "event_type": "alert", "src_ip": "64.89.163.154", "src_port": 57398, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:47:00.483668+0100", "src_ip": "64.89.163.154", "dest_ip": "185.254.126.122", "src_port": 57398, "dest_port": 3306}}');
INSERT INTO alerts VALUES(284,1772977644.444873095,'{"timestamp": "2026-03-08T14:47:24.444873+0100", "flow_id": 1347766599900891, "event_type": "alert", "src_ip": "65.49.1.170", "src_port": 52795, "dest_ip": "185.254.126.122", "dest_port": 50070, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:47:24.444873+0100", "src_ip": "65.49.1.170", "dest_ip": "185.254.126.122", "src_port": 52795, "dest_port": 50070}}');
INSERT INTO alerts VALUES(285,1772977657.760354043,'{"timestamp": "2026-03-08T14:47:37.760354+0100", "flow_id": 450948415718539, "event_type": "alert", "src_ip": "64.62.156.133", "src_port": 55238, "dest_ip": "185.254.126.122", "dest_port": 2323, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:47:37.760354+0100", "src_ip": "64.62.156.133", "dest_ip": "185.254.126.122", "src_port": 55238, "dest_port": 2323}}');
INSERT INTO alerts VALUES(286,1772977678.790333986,'{"timestamp": "2026-03-08T14:47:58.790334+0100", "flow_id": 1705611108388327, "event_type": "alert", "src_ip": "185.242.226.61", "src_port": 47537, "dest_ip": "185.254.126.122", "dest_port": 10633, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:47:58.790334+0100", "src_ip": "185.242.226.61", "dest_ip": "185.254.126.122", "src_port": 47537, "dest_port": 10633}}');
INSERT INTO alerts VALUES(287,1772977679.146720886,'{"timestamp": "2026-03-08T14:47:59.146721+0100", "flow_id": 2037540990493370, "event_type": "alert", "src_ip": "198.38.89.100", "src_port": 45865, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:47:59.146721+0100", "src_ip": "198.38.89.100", "dest_ip": "185.254.126.122", "src_port": 45865, "dest_port": 1433}}');
INSERT INTO alerts VALUES(288,1772977707.427251101,'{"timestamp": "2026-03-08T14:48:27.427251+0100", "flow_id": 990605684423138, "event_type": "alert", "src_ip": "64.62.156.214", "src_port": 37543, "dest_ip": "185.254.126.122", "dest_port": 2375, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:48:27.427251+0100", "src_ip": "64.62.156.214", "dest_ip": "185.254.126.122", "src_port": 37543, "dest_port": 2375}}');
INSERT INTO alerts VALUES(289,1772977745.803937911,'{"timestamp": "2026-03-08T14:49:05.803938+0100", "flow_id": 356665957727382, "event_type": "alert", "src_ip": "193.163.125.35", "src_port": 38126, "dest_ip": "185.254.126.122", "dest_port": 9015, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:49:05.803938+0100", "src_ip": "193.163.125.35", "dest_ip": "185.254.126.122", "src_port": 38126, "dest_port": 9015}}');
INSERT INTO alerts VALUES(290,1772977764.452572108,'{"timestamp": "2026-03-08T14:49:24.452572+0100", "flow_id": 1380833434061771, "event_type": "alert", "src_ip": "64.62.197.84", "src_port": 58569, "dest_ip": "185.254.126.122", "dest_port": 1911, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:49:24.452572+0100", "src_ip": "64.62.197.84", "dest_ip": "185.254.126.122", "src_port": 58569, "dest_port": 1911}}');
INSERT INTO alerts VALUES(291,1772977901.854152918,'{"timestamp": "2026-03-08T14:51:41.854153+0100", "flow_id": 1416762149649366, "event_type": "alert", "src_ip": "45.142.154.99", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 18080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:51:41.854153+0100", "src_ip": "45.142.154.99", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 18080}}');
INSERT INTO alerts VALUES(292,1772977912.220045089,'{"timestamp": "2026-03-08T14:51:52.220045+0100", "flow_id": 100661274231855, "event_type": "alert", "src_ip": "65.49.1.150", "src_port": 48757, "dest_ip": "185.254.126.122", "dest_port": 61617, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:51:52.220045+0100", "src_ip": "65.49.1.150", "dest_ip": "185.254.126.122", "src_port": 48757, "dest_port": 61617}}');
INSERT INTO alerts VALUES(293,1772977953.834024907,'{"timestamp": "2026-03-08T14:52:33.834025+0100", "flow_id": 485888926761719, "event_type": "alert", "src_ip": "65.49.1.112", "src_port": 53811, "dest_ip": "185.254.126.122", "dest_port": 63210, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:52:33.834025+0100", "src_ip": "65.49.1.112", "dest_ip": "185.254.126.122", "src_port": 53811, "dest_port": 63210}}');
INSERT INTO alerts VALUES(294,1772977967.267400026,'{"timestamp": "2026-03-08T14:52:47.267400+0100", "flow_id": 1992902314480801, "event_type": "alert", "src_ip": "103.31.82.141", "src_port": 40947, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:52:47.267400+0100", "src_ip": "103.31.82.141", "dest_ip": "185.254.126.122", "src_port": 40947, "dest_port": 1433}}');
INSERT INTO alerts VALUES(295,1772978004.295329093,'{"timestamp": "2026-03-08T14:53:24.295329+0100", "flow_id": 1268428987857058, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 59680, "dest_ip": "185.254.126.122", "dest_port": 4001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:53:24.295329+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 59680, "dest_port": 4001}}');
INSERT INTO alerts VALUES(296,1772978036.751208067,'{"timestamp": "2026-03-08T14:53:56.751208+0100", "flow_id": 1255980536490385, "event_type": "alert", "src_ip": "54.83.110.109", "src_port": 443, "dest_ip": "192.168.2.20", "dest_port": 56247, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.greencolumnart.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.greencolumnart.com"], "serial": "4B:EF:18:4A:8A:7C:65:6C:1F:EA:F5:F8:CF:8B:44:B9", "fingerprint": "67:5a:2e:5e:86:89:c8:05:8e:e1:94:82:25:7e:42:a6:0f:98:18:04", "sni": "obs.greencolumnart.com", "version": "TLS 1.2", "notbefore": "2026-01-22T00:00:00", "notafter": "2026-04-22T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3727, "start": "2026-03-08T14:53:56.554574+0100", "src_ip": "192.168.2.20", "dest_ip": "54.83.110.109", "src_port": 56247, "dest_port": 443}}');
INSERT INTO alerts VALUES(297,1772978062.809751034,'{"timestamp": "2026-03-08T14:54:22.809751+0100", "flow_id": 1789007109473370, "event_type": "alert", "src_ip": "170.82.253.76", "src_port": 41424, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:54:22.809751+0100", "src_ip": "170.82.253.76", "dest_ip": "185.254.126.122", "src_port": 41424, "dest_port": 1433}}');
INSERT INTO alerts VALUES(298,1772978154.10167098,'{"timestamp": "2026-03-08T14:55:54.101671+0100", "flow_id": 718149674629553, "event_type": "alert", "src_ip": "185.254.95.141", "src_port": 58141, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:55:54.101671+0100", "src_ip": "185.254.95.141", "dest_ip": "185.254.126.122", "src_port": 58141, "dest_port": 1433}}');
INSERT INTO alerts VALUES(299,1772978167.896723031,'{"timestamp": "2026-03-08T14:56:07.896723+0100", "flow_id": 2162548169987210, "event_type": "alert", "src_ip": "167.94.138.150", "src_port": 15155, "dest_ip": "185.254.126.122", "dest_port": 4839, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:56:07.896723+0100", "src_ip": "167.94.138.150", "dest_ip": "185.254.126.122", "src_port": 15155, "dest_port": 4839}}');
INSERT INTO alerts VALUES(300,1772978170.863950967,'{"timestamp": "2026-03-08T14:56:10.863951+0100", "flow_id": 614419758101140, "event_type": "alert", "src_ip": "65.49.1.93", "src_port": 38266, "dest_ip": "185.254.126.122", "dest_port": 2001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:56:10.863951+0100", "src_ip": "65.49.1.93", "dest_ip": "185.254.126.122", "src_port": 38266, "dest_port": 2001}}');
INSERT INTO alerts VALUES(301,1772978179.223906041,'{"timestamp": "2026-03-08T14:56:19.223906+0100", "flow_id": 961671031451438, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 52743, "dest_ip": "185.254.126.122", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:56:19.223906+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 52743, "dest_port": 8081}}');
INSERT INTO alerts VALUES(302,1772978255.826021909,'{"timestamp": "2026-03-08T14:57:35.826022+0100", "flow_id": 2140363918711364, "event_type": "alert", "src_ip": "167.94.146.33", "src_port": 7666, "dest_ip": "185.254.126.122", "dest_port": 28756, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T14:57:35.826022+0100", "src_ip": "167.94.146.33", "dest_ip": "185.254.126.122", "src_port": 7666, "dest_port": 28756}}');
INSERT INTO alerts VALUES(303,1772978323.258819103,'{"timestamp": "2026-03-08T14:58:43.258819+0100", "flow_id": 1111620896924354, "event_type": "alert", "src_ip": "64.89.163.244", "src_port": 58222, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T14:58:43.258819+0100", "src_ip": "64.89.163.244", "dest_ip": "185.254.126.122", "src_port": 58222, "dest_port": 27017}}');
INSERT INTO alerts VALUES(304,1772978351.37641406,'{"timestamp": "2026-03-08T14:59:11.376414+0100", "flow_id": 2179638336929960, "event_type": "alert", "src_ip": "64.62.156.149", "src_port": 48201, "dest_ip": "185.254.126.122", "dest_port": 502, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:59:11.376414+0100", "src_ip": "64.62.156.149", "dest_ip": "185.254.126.122", "src_port": 48201, "dest_port": 502}}');
INSERT INTO alerts VALUES(305,1772978359.588695049,'{"timestamp": "2026-03-08T14:59:19.588695+0100", "flow_id": 2246951673986149, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 541, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T14:59:19.588695+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 541}}');
INSERT INTO alerts VALUES(306,1772978359.632603884,'{"timestamp": "2026-03-08T14:59:19.632604+0100", "flow_id": 2154064430409254, "event_type": "alert", "src_ip": "167.94.138.133", "src_port": 33553, "dest_ip": "185.254.126.122", "dest_port": 427, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 75, "bytes_toclient": 0, "start": "2026-03-08T14:59:19.632604+0100", "src_ip": "167.94.138.133", "dest_ip": "185.254.126.122", "src_port": 33553, "dest_port": 427}}');
INSERT INTO alerts VALUES(307,1772978617.040899992,'{"timestamp": "2026-03-08T15:03:37.040900+0100", "flow_id": 457139305095300, "event_type": "alert", "src_ip": "64.62.197.238", "src_port": 37827, "dest_ip": "185.254.126.122", "dest_port": 110, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:03:37.040900+0100", "src_ip": "64.62.197.238", "dest_ip": "185.254.126.122", "src_port": 37827, "dest_port": 110}}');
INSERT INTO alerts VALUES(308,1772978623.503376008,'{"timestamp": "2026-03-08T15:03:43.503376+0100", "flow_id": 2161984710361720, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 50089, "dest_ip": "185.254.126.122", "dest_port": 17701, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:03:43.503376+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 50089, "dest_port": 17701}}');
INSERT INTO alerts VALUES(309,1772978655.803062916,'{"timestamp": "2026-03-08T15:04:15.803063+0100", "flow_id": 2041757672264833, "event_type": "alert", "src_ip": "45.153.34.117", "src_port": 36565, "dest_ip": "185.254.126.122", "dest_port": 52678, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:04:15.803063+0100", "src_ip": "45.153.34.117", "dest_ip": "185.254.126.122", "src_port": 36565, "dest_port": 52678}}');
INSERT INTO alerts VALUES(310,1772978673.298707008,'{"timestamp": "2026-03-08T15:04:33.298707+0100", "flow_id": 438513154925701, "event_type": "alert", "src_ip": "185.196.11.50", "src_port": 57441, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:04:33.298707+0100", "src_ip": "185.196.11.50", "dest_ip": "185.254.126.122", "src_port": 57441, "dest_port": 443}}');
INSERT INTO alerts VALUES(311,1772978764.377511024,'{"timestamp": "2026-03-08T15:06:04.377511+0100", "flow_id": 1339924603349364, "event_type": "alert", "src_ip": "45.135.194.48", "src_port": 44702, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:06:04.377511+0100", "src_ip": "45.135.194.48", "dest_ip": "185.254.126.122", "src_port": 44702, "dest_port": 5555}}');
INSERT INTO alerts VALUES(312,1772978767.736008883,'{"timestamp": "2026-03-08T15:06:07.736009+0100", "flow_id": 2035236772257529, "event_type": "alert", "src_ip": "64.89.160.47", "src_port": 41074, "dest_ip": "185.254.126.122", "dest_port": 6377, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:06:07.736009+0100", "src_ip": "64.89.160.47", "dest_ip": "185.254.126.122", "src_port": 41074, "dest_port": 6377}}');
INSERT INTO alerts VALUES(313,1772978767.736008883,'{"timestamp": "2026-03-08T15:06:07.736009+0100", "flow_id": 2035236772257529, "event_type": "alert", "src_ip": "64.89.160.47", "src_port": 41074, "dest_ip": "185.254.126.122", "dest_port": 6377, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500032, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:06:07.736009+0100", "src_ip": "64.89.160.47", "dest_ip": "185.254.126.122", "src_port": 41074, "dest_port": 6377}}');
INSERT INTO alerts VALUES(314,1772978772.550520896,'{"timestamp": "2026-03-08T15:06:12.550521+0100", "flow_id": 1238573662956981, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 12982, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:06:12.550521+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 12982}}');
INSERT INTO alerts VALUES(315,1772978779.102061987,'{"timestamp": "2026-03-08T15:06:19.102062+0100", "flow_id": 1001306210571311, "event_type": "alert", "src_ip": "64.89.163.154", "src_port": 58640, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:06:19.102062+0100", "src_ip": "64.89.163.154", "dest_ip": "185.254.126.122", "src_port": 58640, "dest_port": 3306}}');
INSERT INTO alerts VALUES(316,1772978794.107745885,'{"timestamp": "2026-03-08T15:06:34.107746+0100", "flow_id": 744242972815247, "event_type": "alert", "src_ip": "65.49.1.25", "src_port": 34859, "dest_ip": "185.254.126.122", "dest_port": 5805, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:06:34.107746+0100", "src_ip": "65.49.1.25", "dest_ip": "185.254.126.122", "src_port": 34859, "dest_port": 5805}}');
INSERT INTO alerts VALUES(317,1772978818.852236987,'{"timestamp": "2026-03-08T15:06:58.852237+0100", "flow_id": 564107305682488, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2019, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:06:58.852237+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2019}}');
INSERT INTO alerts VALUES(318,1772978818.852236987,'{"timestamp": "2026-03-08T15:06:58.852237+0100", "flow_id": 564107305682488, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2019, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:06:58.852237+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2019}}');
INSERT INTO alerts VALUES(319,1772978824.45904708,'{"timestamp": "2026-03-08T15:07:04.459047+0100", "flow_id": 1267157985310, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 57043, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:07:04.459047+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 57043, "dest_port": 8545}}');
INSERT INTO alerts VALUES(320,1772978824.45904708,'{"timestamp": "2026-03-08T15:07:04.459047+0100", "flow_id": 1267157985310, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 57043, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:07:04.459047+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 57043, "dest_port": 8545}}');
INSERT INTO alerts VALUES(321,1772978847.110227109,'{"timestamp": "2026-03-08T15:07:27.110227+0100", "flow_id": 2162272647177939, "event_type": "alert", "src_ip": "64.89.160.47", "src_port": 37577, "dest_ip": "185.254.126.122", "dest_port": 42412, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500032, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:07:27.110227+0100", "src_ip": "64.89.160.47", "dest_ip": "185.254.126.122", "src_port": 37577, "dest_port": 42412}}');
INSERT INTO alerts VALUES(322,1772978895.225888968,'{"timestamp": "2026-03-08T15:08:15.225889+0100", "flow_id": 2096089983004347, "event_type": "alert", "src_ip": "45.156.87.10", "src_port": 58867, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:08:15.225889+0100", "src_ip": "45.156.87.10", "dest_ip": "185.254.126.122", "src_port": 58867, "dest_port": 27017}}');
INSERT INTO alerts VALUES(323,1772978924.517597914,'{"timestamp": "2026-03-08T15:08:44.517598+0100", "flow_id": 1378644550848378, "event_type": "alert", "src_ip": "185.156.73.181", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 24431, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:08:44.517598+0100", "src_ip": "185.156.73.181", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 24431}}');
INSERT INTO alerts VALUES(324,1772978925.454385043,'{"timestamp": "2026-03-08T15:08:45.454385+0100", "flow_id": 1670095020810037, "event_type": "alert", "src_ip": "64.95.96.68", "src_port": 5718, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 432, "bytes_toclient": 0, "start": "2026-03-08T15:08:45.454385+0100", "src_ip": "64.95.96.68", "dest_ip": "185.254.126.122", "src_port": 5718, "dest_port": 5060}}');
INSERT INTO alerts VALUES(325,1772978925.454385043,'{"timestamp": "2026-03-08T15:08:45.454385+0100", "flow_id": 1670095020810037, "event_type": "alert", "src_ip": "64.95.96.68", "src_port": 5718, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 432, "bytes_toclient": 0, "start": "2026-03-08T15:08:45.454385+0100", "src_ip": "64.95.96.68", "dest_ip": "185.254.126.122", "src_port": 5718, "dest_port": 5060}}');
INSERT INTO alerts VALUES(326,1772978951.137222052,'{"timestamp": "2026-03-08T15:09:11.137222+0100", "flow_id": 1996739036582411, "event_type": "alert", "src_ip": "176.65.134.22", "src_port": 40235, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:09:11.137222+0100", "src_ip": "176.65.134.22", "dest_ip": "185.254.126.122", "src_port": 40235, "dest_port": 22}}');
INSERT INTO alerts VALUES(327,1772978997.056056977,'{"timestamp": "2026-03-08T15:09:57.056057+0100", "flow_id": 1648140591896778, "event_type": "alert", "src_ip": "64.89.160.47", "src_port": 37165, "dest_ip": "185.254.126.122", "dest_port": 1145, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500032, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 17", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:09:57.056057+0100", "src_ip": "64.89.160.47", "dest_ip": "185.254.126.122", "src_port": 37165, "dest_port": 1145}}');
INSERT INTO alerts VALUES(328,1772979047.567065954,'{"timestamp": "2026-03-08T15:10:47.567066+0100", "flow_id": 2154056241856737, "event_type": "alert", "src_ip": "167.94.138.149", "src_port": 4988, "dest_ip": "185.254.126.122", "dest_port": 2363, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 42, "bytes_toclient": 0, "start": "2026-03-08T15:10:47.567066+0100", "src_ip": "167.94.138.149", "dest_ip": "185.254.126.122", "src_port": 4988, "dest_port": 2363}}');
INSERT INTO alerts VALUES(329,1772979122.942819118,'{"timestamp": "2026-03-08T15:12:02.942819+0100", "flow_id": 671679898747074, "event_type": "alert", "src_ip": "64.89.163.23", "src_port": 56433, "dest_ip": "185.254.126.122", "dest_port": 465, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:12:02.942819+0100", "src_ip": "64.89.163.23", "dest_ip": "185.254.126.122", "src_port": 56433, "dest_port": 465}}');
INSERT INTO alerts VALUES(330,1772979181.502993107,'{"timestamp": "2026-03-08T15:13:01.502993+0100", "flow_id": 1597388901963030, "event_type": "alert", "src_ip": "64.62.156.169", "src_port": 39718, "dest_ip": "185.254.126.122", "dest_port": 61616, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:13:01.502993+0100", "src_ip": "64.62.156.169", "dest_ip": "185.254.126.122", "src_port": 39718, "dest_port": 61616}}');
INSERT INTO alerts VALUES(331,1772979275.018647909,'{"timestamp": "2026-03-08T15:14:35.018648+0100", "flow_id": 924520226850912, "event_type": "alert", "src_ip": "204.76.203.73", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:14:35.018648+0100", "src_ip": "204.76.203.73", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 80}}');
INSERT INTO alerts VALUES(332,1772979275.018647909,'{"timestamp": "2026-03-08T15:14:35.018648+0100", "flow_id": 924520226850912, "event_type": "alert", "src_ip": "204.76.203.73", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:14:35.018648+0100", "src_ip": "204.76.203.73", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 80}}');
INSERT INTO alerts VALUES(333,1772979280.835081101,'{"timestamp": "2026-03-08T15:14:40.835081+0100", "flow_id": 208946456549767, "event_type": "alert", "src_ip": "45.156.87.24", "src_port": 49741, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:14:40.835081+0100", "src_ip": "45.156.87.24", "dest_ip": "185.254.126.122", "src_port": 49741, "dest_port": 5555}}');
INSERT INTO alerts VALUES(334,1772979316.877593995,'{"timestamp": "2026-03-08T15:15:16.877594+0100", "flow_id": 1235964534233565, "event_type": "alert", "src_ip": "167.94.138.97", "src_port": 60224, "dest_ip": "185.254.126.122", "dest_port": 13940, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:15:16.877594+0100", "src_ip": "167.94.138.97", "dest_ip": "185.254.126.122", "src_port": 60224, "dest_port": 13940}}');
INSERT INTO alerts VALUES(335,1772979350.153620959,'{"timestamp": "2026-03-08T15:15:50.153621+0100", "flow_id": 1785700801563926, "event_type": "alert", "src_ip": "130.12.181.157", "src_port": 53995, "dest_ip": "185.254.126.122", "dest_port": 2528, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:15:50.153621+0100", "src_ip": "130.12.181.157", "dest_ip": "185.254.126.122", "src_port": 53995, "dest_port": 2528}}');
INSERT INTO alerts VALUES(336,1772979350.153620959,'{"timestamp": "2026-03-08T15:15:50.153621+0100", "flow_id": 1785700801563926, "event_type": "alert", "src_ip": "130.12.181.157", "src_port": 53995, "dest_ip": "185.254.126.122", "dest_port": 2528, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500006, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:15:50.153621+0100", "src_ip": "130.12.181.157", "dest_ip": "185.254.126.122", "src_port": 53995, "dest_port": 2528}}');
INSERT INTO alerts VALUES(337,1772979382.998568058,'{"timestamp": "2026-03-08T15:16:22.998568+0100", "flow_id": 1755546297147624, "event_type": "alert", "src_ip": "66.132.153.153", "src_port": 45773, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 46, "bytes_toclient": 0, "start": "2026-03-08T15:16:22.998568+0100", "src_ip": "66.132.153.153", "dest_ip": "185.254.126.122", "src_port": 45773, "dest_port": 3389}}');
INSERT INTO alerts VALUES(338,1772979410.487582922,'{"timestamp": "2026-03-08T15:16:50.487583+0100", "flow_id": 686782173724125, "event_type": "alert", "src_ip": "130.12.181.157", "src_port": 33752, "dest_ip": "185.254.126.122", "dest_port": 21080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500006, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:16:50.487583+0100", "src_ip": "130.12.181.157", "dest_ip": "185.254.126.122", "src_port": 33752, "dest_port": 21080}}');
INSERT INTO alerts VALUES(339,1772979566.41088295,'{"timestamp": "2026-03-08T15:19:26.410883+0100", "flow_id": 1764731080536225, "event_type": "alert", "src_ip": "130.12.181.157", "src_port": 46508, "dest_ip": "185.254.126.122", "dest_port": 8989, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500006, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:19:26.410883+0100", "src_ip": "130.12.181.157", "dest_ip": "185.254.126.122", "src_port": 46508, "dest_port": 8989}}');
INSERT INTO alerts VALUES(340,1772979694.411992073,'{"timestamp": "2026-03-08T15:21:34.411992+0100", "flow_id": 1769496215121366, "event_type": "alert", "src_ip": "43.228.157.14", "src_port": 40953, "dest_ip": "185.254.126.122", "dest_port": 24442, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:21:34.411992+0100", "src_ip": "43.228.157.14", "dest_ip": "185.254.126.122", "src_port": 40953, "dest_port": 24442}}');
INSERT INTO alerts VALUES(341,1772979722.447546006,'{"timestamp": "2026-03-08T15:22:02.447546+0100", "flow_id": 796298226694662, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 10201, "dest_ip": "185.254.126.122", "dest_port": 5580, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:22:02.447546+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 10201, "dest_port": 5580}}');
INSERT INTO alerts VALUES(342,1772979751.222141027,'{"timestamp": "2026-03-08T15:22:31.222141+0100", "flow_id": 2079988906977732, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55312, "dest_ip": "185.254.126.122", "dest_port": 24220, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:22:31.222141+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 55312, "dest_port": 24220}}');
INSERT INTO alerts VALUES(343,1772979820.78015089,'{"timestamp": "2026-03-08T15:23:40.780151+0100", "flow_id": 1380400178017957, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59755, "dest_ip": "185.254.126.122", "dest_port": 3298, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:23:40.780151+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59755, "dest_port": 3298}}');
INSERT INTO alerts VALUES(344,1772979820.78015089,'{"timestamp": "2026-03-08T15:23:40.780151+0100", "flow_id": 1380400178017957, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59755, "dest_ip": "185.254.126.122", "dest_port": 3298, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:23:40.780151+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59755, "dest_port": 3298}}');
INSERT INTO alerts VALUES(345,1772979906.060815096,'{"timestamp": "2026-03-08T15:25:06.060815+0100", "flow_id": 824151369616408, "event_type": "alert", "src_ip": "176.65.139.45", "src_port": 36710, "dest_ip": "185.254.126.122", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:25:06.060815+0100", "src_ip": "176.65.139.45", "dest_ip": "185.254.126.122", "src_port": 36710, "dest_port": 17000}}');
INSERT INTO alerts VALUES(346,1772979976.820085048,'{"timestamp": "2026-03-08T15:26:16.820085+0100", "flow_id": 144542452003644, "event_type": "alert", "src_ip": "64.62.197.198", "src_port": 34679, "dest_ip": "185.254.126.122", "dest_port": 1337, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:26:16.820085+0100", "src_ip": "64.62.197.198", "dest_ip": "185.254.126.122", "src_port": 34679, "dest_port": 1337}}');
INSERT INTO alerts VALUES(347,1772980005.626754046,'{"timestamp": "2026-03-08T15:26:45.626754+0100", "flow_id": 1565988098015418, "event_type": "alert", "src_ip": "64.62.156.53", "src_port": 47118, "dest_ip": "185.254.126.122", "dest_port": 49664, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:26:45.626754+0100", "src_ip": "64.62.156.53", "dest_ip": "185.254.126.122", "src_port": 47118, "dest_port": 49664}}');
INSERT INTO alerts VALUES(348,1772980027.307018996,'{"timestamp": "2026-03-08T15:27:07.307019+0100", "flow_id": 1037162284729467, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 56784, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 25924, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:27:07.307019+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 56784, "dest_port": 53}}');
INSERT INTO alerts VALUES(349,1772980027.307019949,'{"timestamp": "2026-03-08T15:27:07.307020+0100", "flow_id": 1037169041657053, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 57798, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 22714, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:27:07.307020+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 57798, "dest_port": 53}}');
INSERT INTO alerts VALUES(350,1772980027.307019949,'{"timestamp": "2026-03-08T15:27:07.307020+0100", "flow_id": 1037168762901710, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 33596, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 8933, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:27:07.307020+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 33596, "dest_port": 53}}');
INSERT INTO alerts VALUES(351,1772980174.632450103,'{"timestamp": "2026-03-08T15:29:34.632450+0100", "flow_id": 1871930840807342, "event_type": "alert", "src_ip": "193.163.125.37", "src_port": 37381, "dest_ip": "185.254.126.122", "dest_port": 21845, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:29:34.632450+0100", "src_ip": "193.163.125.37", "dest_ip": "185.254.126.122", "src_port": 37381, "dest_port": 21845}}');
INSERT INTO alerts VALUES(352,1772980190.405270099,'{"timestamp": "2026-03-08T15:29:50.405270+0100", "flow_id": 1740622598521962, "event_type": "alert", "src_ip": "64.62.197.59", "src_port": 60132, "dest_ip": "185.254.126.122", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:29:50.405270+0100", "src_ip": "64.62.197.59", "dest_ip": "185.254.126.122", "src_port": 60132, "dest_port": 3001}}');
INSERT INTO alerts VALUES(353,1772980268.981903077,'{"timestamp": "2026-03-08T15:31:08.981903+0100", "flow_id": 1402492493568460, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 56649, "dest_ip": "185.254.126.122", "dest_port": 2202, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:31:08.981903+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 56649, "dest_port": 2202}}');
INSERT INTO alerts VALUES(354,1772980268.981903077,'{"timestamp": "2026-03-08T15:31:08.981903+0100", "flow_id": 1402492493568460, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 56649, "dest_ip": "185.254.126.122", "dest_port": 2202, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:31:08.981903+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 56649, "dest_port": 2202}}');
INSERT INTO alerts VALUES(355,1772980345.519526958,'{"timestamp": "2026-03-08T15:32:25.519527+0100", "flow_id": 542502995580290, "event_type": "alert", "src_ip": "195.184.76.28", "src_port": 26479, "dest_ip": "185.254.126.122", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:32:25.519527+0100", "src_ip": "195.184.76.28", "dest_ip": "185.254.126.122", "src_port": 26479, "dest_port": 8081}}');
INSERT INTO alerts VALUES(356,1772980351.500325918,'{"timestamp": "2026-03-08T15:32:31.500326+0100", "flow_id": 2148884491113062, "event_type": "alert", "src_ip": "167.94.146.41", "src_port": 32401, "dest_ip": "185.254.126.122", "dest_port": 2024, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:32:31.500326+0100", "src_ip": "167.94.146.41", "dest_ip": "185.254.126.122", "src_port": 32401, "dest_port": 2024}}');
INSERT INTO alerts VALUES(357,1772980362.55824089,'{"timestamp": "2026-03-08T15:32:42.558241+0100", "flow_id": 708778380202934, "event_type": "alert", "src_ip": "195.184.76.100", "src_port": 13752, "dest_ip": "185.254.126.122", "dest_port": 7777, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:32:42.558241+0100", "src_ip": "195.184.76.100", "dest_ip": "185.254.126.122", "src_port": 13752, "dest_port": 7777}}');
INSERT INTO alerts VALUES(358,1772980369.600790978,'{"timestamp": "2026-03-08T15:32:49.600791+0100", "flow_id": 328581070665480, "event_type": "alert", "src_ip": "91.196.152.4", "src_port": 32502, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:32:49.600791+0100", "src_ip": "91.196.152.4", "dest_ip": "185.254.126.122", "src_port": 32502, "dest_port": 3306}}');
INSERT INTO alerts VALUES(359,1772980369.600790978,'{"timestamp": "2026-03-08T15:32:49.600791+0100", "flow_id": 328581070665480, "event_type": "alert", "src_ip": "91.196.152.4", "src_port": 32502, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:32:49.600791+0100", "src_ip": "91.196.152.4", "dest_ip": "185.254.126.122", "src_port": 32502, "dest_port": 3306}}');
INSERT INTO alerts VALUES(360,1772980629.271651984,'{"timestamp": "2026-03-08T15:37:09.271652+0100", "flow_id": 1448213137697720, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59003, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 29995, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T15:37:09.271652+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59003, "dest_port": 53}}');
INSERT INTO alerts VALUES(361,1772980629.839574098,'{"timestamp": "2026-03-08T15:37:09.839574+0100", "flow_id": 1635620935338762, "event_type": "alert", "src_ip": "193.163.125.30", "src_port": 45017, "dest_ip": "185.254.126.122", "dest_port": 40120, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:37:09.839574+0100", "src_ip": "193.163.125.30", "dest_ip": "185.254.126.122", "src_port": 45017, "dest_port": 40120}}');
INSERT INTO alerts VALUES(362,1772980637.582231044,'{"timestamp": "2026-03-08T15:37:17.582231+0100", "flow_id": 1656241771213834, "event_type": "alert", "src_ip": "176.65.149.76", "src_port": 45187, "dest_ip": "185.254.126.122", "dest_port": 8070, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:37:17.582231+0100", "src_ip": "176.65.149.76", "dest_ip": "185.254.126.122", "src_port": 45187, "dest_port": 8070}}');
INSERT INTO alerts VALUES(363,1772980644.294059992,'{"timestamp": "2026-03-08T15:37:24.294060+0100", "flow_id": 1196192744635730, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 48416, "dest_ip": "94.130.164.126", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053282, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "ts_progress": "client_hello_done", "tc_progress": "server_in_progress", "tls": {"sni": "relays.syncthing.net", "version": "TLS 1.3", "ja3": {"hash": "473cd7cb9faa642487833865d516e578", "string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0"}, "ja4": "t13d190900_9dc949149365_97f8aa674fd9"}, "app_proto": "tls", "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 1, "bytes_toserver": 432, "bytes_toclient": 60, "start": "2026-03-08T15:37:24.278510+0100", "src_ip": "192.168.2.16", "dest_ip": "94.130.164.126", "src_port": 48416, "dest_port": 443}}');
INSERT INTO alerts VALUES(364,1772980645.390136957,'{"timestamp": "2026-03-08T15:37:25.390137+0100", "flow_id": 1675627027537378, "event_type": "alert", "src_ip": "65.49.1.194", "src_port": 40026, "dest_ip": "185.254.126.122", "dest_port": 22522, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:37:25.390137+0100", "src_ip": "65.49.1.194", "dest_ip": "185.254.126.122", "src_port": 40026, "dest_port": 22522}}');
INSERT INTO alerts VALUES(365,1772980647.738533021,'{"timestamp": "2026-03-08T15:37:27.738533+0100", "flow_id": 2046078653376325, "event_type": "alert", "src_ip": "195.184.76.12", "src_port": 55991, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:37:27.738533+0100", "src_ip": "195.184.76.12", "dest_ip": "185.254.126.122", "src_port": 55991, "dest_port": 8088}}');
INSERT INTO alerts VALUES(366,1772980656.726146936,'{"timestamp": "2026-03-08T15:37:36.726147+0100", "flow_id": 22553151150084, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 49254, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 32251, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:37:36.726147+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 49254, "dest_port": 53}}');
INSERT INTO alerts VALUES(367,1772980656.72614789,'{"timestamp": "2026-03-08T15:37:36.726148+0100", "flow_id": 22558874267661, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 42809, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 37669, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:37:36.726148+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 42809, "dest_port": 53}}');
INSERT INTO alerts VALUES(368,1772980656.72614789,'{"timestamp": "2026-03-08T15:37:36.726148+0100", "flow_id": 22557583493779, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 34671, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 65044, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T15:37:36.726148+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 34671, "dest_port": 53}}');
INSERT INTO alerts VALUES(369,1772980699.803031921,'{"timestamp": "2026-03-08T15:38:19.803032+0100", "flow_id": 915724712890475, "event_type": "alert", "src_ip": "64.62.197.177", "src_port": 46236, "dest_ip": "185.254.126.122", "dest_port": 22122, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:38:19.803032+0100", "src_ip": "64.62.197.177", "dest_ip": "185.254.126.122", "src_port": 46236, "dest_port": 22122}}');
INSERT INTO alerts VALUES(370,1772980798.138375044,'{"timestamp": "2026-03-08T15:39:58.138375+0100", "flow_id": 1720217895443506, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 57816, "dest_ip": "185.254.126.122", "dest_port": 52025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:39:58.138375+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 57816, "dest_port": 52025}}');
INSERT INTO alerts VALUES(371,1772980811.07210207,'{"timestamp": "2026-03-08T15:40:11.072102+0100", "flow_id": 872628638475082, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 24231, "dest_ip": "185.254.126.122", "dest_port": 54521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:40:11.072102+0100", "src_ip": "167.94.146.35", "dest_ip": "185.254.126.122", "src_port": 24231, "dest_port": 54521}}');
INSERT INTO alerts VALUES(372,1772980811.549523116,'{"timestamp": "2026-03-08T15:40:11.549523+0100", "flow_id": 952810633060443, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 57906, "dest_ip": "185.254.126.122", "dest_port": 28770, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:40:11.549523+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 57906, "dest_port": 28770}}');
INSERT INTO alerts VALUES(373,1772980823.352852107,'{"timestamp": "2026-03-08T15:40:23.352852+0100", "flow_id": 2078439502931310, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 10525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:40:23.352852+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 10525}}');
INSERT INTO alerts VALUES(374,1772980823.689249993,'{"timestamp": "2026-03-08T15:40:23.689250+0100", "flow_id": 2115884575608004, "event_type": "alert", "src_ip": "185.156.73.180", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 53443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:40:23.689250+0100", "src_ip": "185.156.73.180", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 53443}}');
INSERT INTO alerts VALUES(375,1772980829.774457931,'{"timestamp": "2026-03-08T15:40:29.774458+0100", "flow_id": 1637422744637909, "event_type": "alert", "src_ip": "176.65.148.4", "src_port": 58489, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:40:29.774458+0100", "src_ip": "176.65.148.4", "dest_ip": "185.254.126.122", "src_port": 58489, "dest_port": 25565}}');
INSERT INTO alerts VALUES(376,1772980829.774457931,'{"timestamp": "2026-03-08T15:40:29.774458+0100", "flow_id": 1637422744637909, "event_type": "alert", "src_ip": "176.65.148.4", "src_port": 58489, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:40:29.774458+0100", "src_ip": "176.65.148.4", "dest_ip": "185.254.126.122", "src_port": 58489, "dest_port": 25565}}');
INSERT INTO alerts VALUES(377,1772980897.237416028,'{"timestamp": "2026-03-08T15:41:37.237416+0100", "flow_id": 456747567470524, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 49962, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:41:37.237416+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 49962, "dest_port": 443}}');
INSERT INTO alerts VALUES(378,1772980897.452095031,'{"timestamp": "2026-03-08T15:41:37.452095+0100", "flow_id": 534361844273463, "event_type": "alert", "src_ip": "66.132.153.153", "src_port": 45680, "dest_ip": "185.254.126.122", "dest_port": 5349, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:41:37.452095+0100", "src_ip": "66.132.153.153", "dest_ip": "185.254.126.122", "src_port": 45680, "dest_port": 5349}}');
INSERT INTO alerts VALUES(379,1772980911.019380092,'{"timestamp": "2026-03-08T15:41:51.019380+0100", "flow_id": 2053562374948795, "event_type": "alert", "src_ip": "193.163.125.13", "src_port": 59138, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:41:51.019380+0100", "src_ip": "193.163.125.13", "dest_ip": "185.254.126.122", "src_port": 59138, "dest_port": 3306}}');
INSERT INTO alerts VALUES(380,1772980911.019380092,'{"timestamp": "2026-03-08T15:41:51.019380+0100", "flow_id": 2053562374948795, "event_type": "alert", "src_ip": "193.163.125.13", "src_port": 59138, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:41:51.019380+0100", "src_ip": "193.163.125.13", "dest_ip": "185.254.126.122", "src_port": 59138, "dest_port": 3306}}');
INSERT INTO alerts VALUES(381,1772980927.34415698,'{"timestamp": "2026-03-08T15:42:07.344157+0100", "flow_id": 2041096872956737, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 39074, "dest_ip": "185.254.126.122", "dest_port": 9090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:42:07.344157+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 39074, "dest_port": 9090}}');
INSERT INTO alerts VALUES(382,1772980930.725150109,'{"timestamp": "2026-03-08T15:42:10.725150+0100", "flow_id": 581222547700758, "event_type": "alert", "src_ip": "64.62.156.103", "src_port": 43944, "dest_ip": "185.254.126.122", "dest_port": 873, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:42:10.725150+0100", "src_ip": "64.62.156.103", "dest_ip": "185.254.126.122", "src_port": 43944, "dest_port": 873}}');
INSERT INTO alerts VALUES(383,1772981035.172468901,'{"timestamp": "2026-03-08T15:43:55.172469+0100", "flow_id": 1022227964077684, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 44551, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:43:55.172469+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 44551, "dest_port": 23}}');
INSERT INTO alerts VALUES(384,1772981035.172468901,'{"timestamp": "2026-03-08T15:43:55.172469+0100", "flow_id": 1022227964077684, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 44551, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:43:55.172469+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 44551, "dest_port": 23}}');
INSERT INTO alerts VALUES(385,1772981220.869481086,'{"timestamp": "2026-03-08T15:47:00.869481+0100", "flow_id": 1201120304086962, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 59277, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:47:00.869481+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 59277, "dest_port": 3389}}');
INSERT INTO alerts VALUES(386,1772981268.788646936,'{"timestamp": "2026-03-08T15:47:48.788647+0100", "flow_id": 1135413813019582, "event_type": "alert", "src_ip": "66.132.153.152", "src_port": 59214, "dest_ip": "185.254.126.122", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:47:48.788647+0100", "src_ip": "66.132.153.152", "dest_ip": "185.254.126.122", "src_port": 59214, "dest_port": 10001}}');
INSERT INTO alerts VALUES(387,1772981299.430335999,'{"timestamp": "2026-03-08T15:48:19.430336+0100", "flow_id": 1003857693274182, "event_type": "alert", "src_ip": "178.20.210.151", "src_port": 52898, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:48:19.430336+0100", "src_ip": "178.20.210.151", "dest_ip": "185.254.126.122", "src_port": 52898, "dest_port": 22}}');
INSERT INTO alerts VALUES(388,1772981343.490191936,'{"timestamp": "2026-03-08T15:49:03.490192+0100", "flow_id": 2105358734110838, "event_type": "alert", "src_ip": "195.184.76.156", "src_port": 16831, "dest_ip": "185.254.126.122", "dest_port": 55443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:49:03.490192+0100", "src_ip": "195.184.76.156", "dest_ip": "185.254.126.122", "src_port": 16831, "dest_port": 55443}}');
INSERT INTO alerts VALUES(389,1772981359.308738947,'{"timestamp": "2026-03-08T15:49:19.308739+0100", "flow_id": 2170450856740126, "event_type": "alert", "src_ip": "167.94.138.151", "src_port": 9442, "dest_ip": "185.254.126.122", "dest_port": 1961, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:49:19.308739+0100", "src_ip": "167.94.138.151", "dest_ip": "185.254.126.122", "src_port": 9442, "dest_port": 1961}}');
INSERT INTO alerts VALUES(390,1772981424.542810916,'{"timestamp": "2026-03-08T15:50:24.542811+0100", "flow_id": 79557181520536, "event_type": "alert", "src_ip": "64.62.197.144", "src_port": 60015, "dest_ip": "185.254.126.122", "dest_port": 5800, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:50:24.542811+0100", "src_ip": "64.62.197.144", "dest_ip": "185.254.126.122", "src_port": 60015, "dest_port": 5800}}');
INSERT INTO alerts VALUES(391,1772981426.484626055,'{"timestamp": "2026-03-08T15:50:26.484626+0100", "flow_id": 674079977960912, "event_type": "alert", "src_ip": "176.65.148.66", "src_port": 50381, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:50:26.484626+0100", "src_ip": "176.65.148.66", "dest_ip": "185.254.126.122", "src_port": 50381, "dest_port": 3000}}');
INSERT INTO alerts VALUES(392,1772981426.484626055,'{"timestamp": "2026-03-08T15:50:26.484626+0100", "flow_id": 674079977960912, "event_type": "alert", "src_ip": "176.65.148.66", "src_port": 50381, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:50:26.484626+0100", "src_ip": "176.65.148.66", "dest_ip": "185.254.126.122", "src_port": 50381, "dest_port": 3000}}');
INSERT INTO alerts VALUES(393,1772981491.606759072,'{"timestamp": "2026-03-08T15:51:31.606759+0100", "flow_id": 917163425099184, "event_type": "alert", "src_ip": "193.163.125.34", "src_port": 49270, "dest_ip": "185.254.126.122", "dest_port": 8531, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:51:31.606759+0100", "src_ip": "193.163.125.34", "dest_ip": "185.254.126.122", "src_port": 49270, "dest_port": 8531}}');
INSERT INTO alerts VALUES(394,1772981515.427350044,'{"timestamp": "2026-03-08T15:51:55.427350+0100", "flow_id": 991032214535575, "event_type": "alert", "src_ip": "64.62.197.198", "src_port": 40903, "dest_ip": "185.254.126.122", "dest_port": 5001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:51:55.427350+0100", "src_ip": "64.62.197.198", "dest_ip": "185.254.126.122", "src_port": 40903, "dest_port": 5001}}');
INSERT INTO alerts VALUES(395,1772981610.26158309,'{"timestamp": "2026-03-08T15:53:30.261583+0100", "flow_id": 842016641838929, "event_type": "alert", "src_ip": "64.89.163.23", "src_port": 56433, "dest_ip": "185.254.126.122", "dest_port": 25, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:53:30.261583+0100", "src_ip": "64.89.163.23", "dest_ip": "185.254.126.122", "src_port": 56433, "dest_port": 25}}');
INSERT INTO alerts VALUES(396,1772981623.547583103,'{"timestamp": "2026-03-08T15:53:43.547583+0100", "flow_id": 2070380385689246, "event_type": "alert", "src_ip": "45.135.194.65", "src_port": 5409, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 57, "bytes_toclient": 0, "start": "2026-03-08T15:53:43.547583+0100", "src_ip": "45.135.194.65", "dest_ip": "185.254.126.122", "src_port": 5409, "dest_port": 53}}');
INSERT INTO alerts VALUES(397,1772981628.456990958,'{"timestamp": "2026-03-08T15:53:48.456991+0100", "flow_id": 1399813129805788, "event_type": "alert", "src_ip": "176.65.139.31", "src_port": 8424, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 67, "bytes_toclient": 0, "start": "2026-03-08T15:53:48.456991+0100", "src_ip": "176.65.139.31", "dest_ip": "185.254.126.122", "src_port": 8424, "dest_port": 389}}');
INSERT INTO alerts VALUES(398,1772981635.802337884,'{"timestamp": "2026-03-08T15:53:55.802338+0100", "flow_id": 912742238458150, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 41340, "dest_ip": "185.254.126.122", "dest_port": 2525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:53:55.802338+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 41340, "dest_port": 2525}}');
INSERT INTO alerts VALUES(399,1772981680.456034898,'{"timestamp": "2026-03-08T15:54:40.456035+0100", "flow_id": 269808830391275, "event_type": "alert", "src_ip": "167.94.146.36", "src_port": 4694, "dest_ip": "185.254.126.122", "dest_port": 52165, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:54:40.456035+0100", "src_ip": "167.94.146.36", "dest_ip": "185.254.126.122", "src_port": 4694, "dest_port": 52165}}');
INSERT INTO alerts VALUES(400,1772981697.638850927,'{"timestamp": "2026-03-08T15:54:57.638851+0100", "flow_id": 492046251667944, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55312, "dest_ip": "185.254.126.122", "dest_port": 20997, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:54:57.638851+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 55312, "dest_port": 20997}}');
INSERT INTO alerts VALUES(401,1772981698.672915936,'{"timestamp": "2026-03-08T15:54:58.672916+0100", "flow_id": 638354059658192, "event_type": "alert", "src_ip": "195.184.76.148", "src_port": 1076, "dest_ip": "185.254.126.122", "dest_port": 52951, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:54:58.672916+0100", "src_ip": "195.184.76.148", "dest_ip": "185.254.126.122", "src_port": 1076, "dest_port": 52951}}');
INSERT INTO alerts VALUES(402,1772981714.08215189,'{"timestamp": "2026-03-08T15:55:14.082152+0100", "flow_id": 634315666181216, "event_type": "alert", "src_ip": "65.49.1.159", "src_port": 43283, "dest_ip": "185.254.126.122", "dest_port": 2000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:55:14.082152+0100", "src_ip": "65.49.1.159", "dest_ip": "185.254.126.122", "src_port": 43283, "dest_port": 2000}}');
INSERT INTO alerts VALUES(403,1772981816.086250066,'{"timestamp": "2026-03-08T15:56:56.086250+0100", "flow_id": 88966794091111, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 36680, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:56:56.086250+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 36680}}');
INSERT INTO alerts VALUES(404,1772981816.086250066,'{"timestamp": "2026-03-08T15:56:56.086250+0100", "flow_id": 88966794091111, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 36680, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:56:56.086250+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 36680}}');
INSERT INTO alerts VALUES(405,1772981822.245215893,'{"timestamp": "2026-03-08T15:57:02.245216+0100", "flow_id": 1897620458581306, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 53108, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:57:02.245216+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 53108, "dest_port": 8545}}');
INSERT INTO alerts VALUES(406,1772981822.245215893,'{"timestamp": "2026-03-08T15:57:02.245216+0100", "flow_id": 1897620458581306, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 53108, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T15:57:02.245216+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 53108, "dest_port": 8545}}');
INSERT INTO alerts VALUES(407,1772981847.195748091,'{"timestamp": "2026-03-08T15:57:27.195748+0100", "flow_id": 2248109721357703, "event_type": "alert", "src_ip": "167.94.146.44", "src_port": 21956, "dest_ip": "185.254.126.122", "dest_port": 3408, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T15:57:27.195748+0100", "src_ip": "167.94.146.44", "dest_ip": "185.254.126.122", "src_port": 21956, "dest_port": 3408}}');
INSERT INTO alerts VALUES(408,1772981871.141413927,'{"timestamp": "2026-03-08T15:57:51.141414+0100", "flow_id": 2014746752692622, "event_type": "alert", "src_ip": "64.62.197.10", "src_port": 38292, "dest_ip": "185.254.126.122", "dest_port": 1723, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:57:51.141414+0100", "src_ip": "64.62.197.10", "dest_ip": "185.254.126.122", "src_port": 38292, "dest_port": 1723}}');
INSERT INTO alerts VALUES(409,1772981911.127892017,'{"timestamp": "2026-03-08T15:58:31.127892+0100", "flow_id": 2238142554034898, "event_type": "alert", "src_ip": "87.121.84.57", "src_port": 59825, "dest_ip": "185.254.126.122", "dest_port": 8181, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T15:58:31.127892+0100", "src_ip": "87.121.84.57", "dest_ip": "185.254.126.122", "src_port": 59825, "dest_port": 8181}}');
INSERT INTO alerts VALUES(410,1772981918.657738925,'{"timestamp": "2026-03-08T15:58:38.657739+0100", "flow_id": 1699070444478570, "event_type": "alert", "src_ip": "185.242.226.87", "src_port": 55780, "dest_ip": "185.254.126.122", "dest_port": 8200, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T15:58:38.657739+0100", "src_ip": "185.242.226.87", "dest_ip": "185.254.126.122", "src_port": 55780, "dest_port": 8200}}');
INSERT INTO alerts VALUES(411,1772982051.375852108,'{"timestamp": "2026-03-08T16:00:51.375852+0100", "flow_id": 1051324799752390, "event_type": "alert", "src_ip": "64.62.156.217", "src_port": 58350, "dest_ip": "185.254.126.122", "dest_port": 5801, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:00:51.375852+0100", "src_ip": "64.62.156.217", "dest_ip": "185.254.126.122", "src_port": 58350, "dest_port": 5801}}');
INSERT INTO alerts VALUES(412,1772982067.580059052,'{"timestamp": "2026-03-08T16:01:07.580059+0100", "flow_id": 1083961644637008, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 35751, "dest_ip": "185.254.126.122", "dest_port": 36282, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:01:07.580059+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 35751, "dest_port": 36282}}');
INSERT INTO alerts VALUES(413,1772982093.956510066,'{"timestamp": "2026-03-08T16:01:33.956510+0100", "flow_id": 1574907982001894, "event_type": "alert", "src_ip": "88.210.63.191", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 31443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:01:33.956510+0100", "src_ip": "88.210.63.191", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 31443}}');
INSERT INTO alerts VALUES(414,1772982118.79122591,'{"timestamp": "2026-03-08T16:01:58.791226+0100", "flow_id": 1709443006557988, "event_type": "alert", "src_ip": "64.62.197.222", "src_port": 37586, "dest_ip": "185.254.126.122", "dest_port": 8001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:01:58.791226+0100", "src_ip": "64.62.197.222", "dest_ip": "185.254.126.122", "src_port": 37586, "dest_port": 8001}}');
INSERT INTO alerts VALUES(415,1772982164.517153979,'{"timestamp": "2026-03-08T16:02:44.517154+0100", "flow_id": 1376737769282370, "event_type": "alert", "src_ip": "45.142.154.10", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ntp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 76, "bytes_toclient": 0, "start": "2026-03-08T16:02:44.517154+0100", "src_ip": "45.142.154.10", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 123}}');
INSERT INTO alerts VALUES(416,1772982165.732769013,'{"timestamp": "2026-03-08T16:02:45.732769+0100", "flow_id": 1458372740713912, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 53222, "dest_ip": "185.254.126.122", "dest_port": 45750, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:02:45.732769+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 53222, "dest_port": 45750}}');
INSERT INTO alerts VALUES(417,1772982186.498567105,'{"timestamp": "2026-03-08T16:03:06.498567+0100", "flow_id": 733958223971213, "event_type": "alert", "src_ip": "178.20.210.152", "src_port": 41612, "dest_ip": "185.254.126.122", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:03:06.498567+0100", "src_ip": "178.20.210.152", "dest_ip": "185.254.126.122", "src_port": 41612, "dest_port": 3001}}');
INSERT INTO alerts VALUES(418,1772982202.566750049,'{"timestamp": "2026-03-08T16:03:22.566750+0100", "flow_id": 745324926560660, "event_type": "alert", "src_ip": "167.94.138.147", "src_port": 16147, "dest_ip": "185.254.126.122", "dest_port": 5902, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:03:22.566750+0100", "src_ip": "167.94.138.147", "dest_ip": "185.254.126.122", "src_port": 16147, "dest_port": 5902}}');
INSERT INTO alerts VALUES(419,1772982345.265608073,'{"timestamp": "2026-03-08T16:05:45.265608+0100", "flow_id": 296354661809009, "event_type": "alert", "src_ip": "193.163.125.20", "src_port": 43603, "dest_ip": "185.254.126.122", "dest_port": 20102, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:05:45.265608+0100", "src_ip": "193.163.125.20", "dest_ip": "185.254.126.122", "src_port": 43603, "dest_port": 20102}}');
INSERT INTO alerts VALUES(420,1772982381.194309949,'{"timestamp": "2026-03-08T16:06:21.194310+0100", "flow_id": 1678984042587869, "event_type": "alert", "src_ip": "178.16.52.218", "src_port": 40814, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:06:21.194310+0100", "src_ip": "178.16.52.218", "dest_ip": "185.254.126.122", "src_port": 40814, "dest_port": 80}}');
INSERT INTO alerts VALUES(421,1772982412.821803092,'{"timestamp": "2026-03-08T16:06:52.821803+0100", "flow_id": 1277819723063414, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 44065, "dest_ip": "185.254.126.122", "dest_port": 1094, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:06:52.821803+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 44065, "dest_port": 1094}}');
INSERT INTO alerts VALUES(422,1772982423.243834972,'{"timestamp": "2026-03-08T16:07:03.243835+0100", "flow_id": 2173166323928449, "event_type": "alert", "src_ip": "52.146.90.191", "src_port": 34361, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:07:03.243835+0100", "src_ip": "52.146.90.191", "dest_ip": "185.254.126.122", "src_port": 34361, "dest_port": 3306}}');
INSERT INTO alerts VALUES(423,1772982433.802041054,'{"timestamp": "2026-03-08T16:07:13.802041+0100", "flow_id": 348516830134667, "event_type": "alert", "src_ip": "193.163.125.17", "src_port": 48855, "dest_ip": "185.254.126.122", "dest_port": 5010, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:07:13.802041+0100", "src_ip": "193.163.125.17", "dest_ip": "185.254.126.122", "src_port": 48855, "dest_port": 5010}}');
INSERT INTO alerts VALUES(424,1772982462.431876897,'{"timestamp": "2026-03-08T16:07:42.431877+0100", "flow_id": 1854898706125948, "event_type": "alert", "src_ip": "185.242.226.108", "src_port": 38408, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:07:42.431877+0100", "src_ip": "185.242.226.108", "dest_ip": "185.254.126.122", "src_port": 38408, "dest_port": 80}}');
INSERT INTO alerts VALUES(425,1772982473.2489779,'{"timestamp": "2026-03-08T16:07:53.248978+0100", "flow_id": 506405866285413, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 43597, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:07:53.248978+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 43597, "dest_port": 443}}');
INSERT INTO alerts VALUES(426,1772982473.2489779,'{"timestamp": "2026-03-08T16:07:53.248978+0100", "flow_id": 506405866285413, "event_type": "alert", "src_ip": "204.76.203.18", "src_port": 43597, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:07:53.248978+0100", "src_ip": "204.76.203.18", "dest_ip": "185.254.126.122", "src_port": 43597, "dest_port": 443}}');
INSERT INTO alerts VALUES(427,1772982493.046178102,'{"timestamp": "2026-03-08T16:08:13.046178+0100", "flow_id": 1605709488647841, "event_type": "alert", "src_ip": "192.168.2.20", "src_port": 63731, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2057745, "rev": 1, "signature": "ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_11_20"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_11_20"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 54218, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "kaufradar-teaser.pages.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 72, "bytes_toclient": 0, "start": "2026-03-08T16:08:13.046178+0100", "src_ip": "192.168.2.20", "dest_ip": "192.168.2.1", "src_port": 63731, "dest_port": 53}}');
INSERT INTO alerts VALUES(428,1772982583.441432,'{"timestamp": "2026-03-08T16:09:43.441432+0100", "flow_id": 2177411352080296, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 54977, "dest_ip": "185.254.126.122", "dest_port": 8968, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:09:43.441432+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 54977, "dest_port": 8968}}');
INSERT INTO alerts VALUES(429,1772982593.318993092,'{"timestamp": "2026-03-08T16:09:53.318993+0100", "flow_id": 525641132905385, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 55555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:09:53.318993+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 55555}}');
INSERT INTO alerts VALUES(430,1772982623.864649057,'{"timestamp": "2026-03-08T16:10:23.864649+0100", "flow_id": 2024789963708310, "event_type": "alert", "src_ip": "64.89.163.134", "src_port": 42604, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:10:23.864649+0100", "src_ip": "64.89.163.134", "dest_ip": "185.254.126.122", "src_port": 42604, "dest_port": 5432}}');
INSERT INTO alerts VALUES(431,1772982623.864649057,'{"timestamp": "2026-03-08T16:10:23.864649+0100", "flow_id": 2024789963708310, "event_type": "alert", "src_ip": "64.89.163.134", "src_port": 42604, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:10:23.864649+0100", "src_ip": "64.89.163.134", "dest_ip": "185.254.126.122", "src_port": 42604, "dest_port": 5432}}');
INSERT INTO alerts VALUES(432,1772982645.049240112,'{"timestamp": "2026-03-08T16:10:45.049240+0100", "flow_id": 1618861834004802, "event_type": "alert", "src_ip": "193.163.125.24", "src_port": 54849, "dest_ip": "185.254.126.122", "dest_port": 20211, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:10:45.049240+0100", "src_ip": "193.163.125.24", "dest_ip": "185.254.126.122", "src_port": 54849, "dest_port": 20211}}');
INSERT INTO alerts VALUES(433,1772982659.086494923,'{"timestamp": "2026-03-08T16:10:59.086495+0100", "flow_id": 934445011851045, "event_type": "alert", "src_ip": "205.210.31.66", "src_port": 49253, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-08T16:10:59.086495+0100", "src_ip": "205.210.31.66", "dest_ip": "185.254.126.122", "src_port": 49253, "dest_port": 161}}');
INSERT INTO alerts VALUES(434,1772982659.086494923,'{"timestamp": "2026-03-08T16:10:59.086495+0100", "flow_id": 934445011851045, "event_type": "alert", "src_ip": "205.210.31.66", "src_port": 49253, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-08T16:10:59.086495+0100", "src_ip": "205.210.31.66", "dest_ip": "185.254.126.122", "src_port": 49253, "dest_port": 161}}');
INSERT INTO alerts VALUES(435,1772982748.459856986,'{"timestamp": "2026-03-08T16:12:28.459857+0100", "flow_id": 1130650119023993, "event_type": "alert", "src_ip": "176.65.148.65", "src_port": 57439, "dest_ip": "185.254.126.122", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 36, "bytes_toclient": 0, "start": "2026-03-08T16:12:28.459857+0100", "src_ip": "176.65.148.65", "dest_ip": "185.254.126.122", "src_port": 57439, "dest_port": 123}}');
INSERT INTO alerts VALUES(436,1772982748.459856986,'{"timestamp": "2026-03-08T16:12:28.459857+0100", "flow_id": 1130650119023993, "event_type": "alert", "src_ip": "176.65.148.65", "src_port": 57439, "dest_ip": "185.254.126.122", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 36, "bytes_toclient": 0, "start": "2026-03-08T16:12:28.459857+0100", "src_ip": "176.65.148.65", "dest_ip": "185.254.126.122", "src_port": 57439, "dest_port": 123}}');
INSERT INTO alerts VALUES(437,1772982826.703056098,'{"timestamp": "2026-03-08T16:13:46.703056+0100", "flow_id": 767802976497768, "event_type": "alert", "src_ip": "185.156.73.181", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 64432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:13:46.703056+0100", "src_ip": "185.156.73.181", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 64432}}');
INSERT INTO alerts VALUES(438,1772982852.657496929,'{"timestamp": "2026-03-08T16:14:12.657497+0100", "flow_id": 1135078407871130, "event_type": "alert", "src_ip": "45.153.34.187", "src_port": 51349, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:14:12.657497+0100", "src_ip": "45.153.34.187", "dest_ip": "185.254.126.122", "src_port": 51349, "dest_port": 80}}');
INSERT INTO alerts VALUES(439,1772983127.678901911,'{"timestamp": "2026-03-08T16:18:47.678902+0100", "flow_id": 2071439756189379, "event_type": "alert", "src_ip": "87.121.84.76", "src_port": 37025, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:18:47.678902+0100", "src_ip": "87.121.84.76", "dest_ip": "185.254.126.122", "src_port": 37025, "dest_port": 80}}');
INSERT INTO alerts VALUES(440,1772983165.272049904,'{"timestamp": "2026-03-08T16:19:25.272050+0100", "flow_id": 1449922172572110, "event_type": "alert", "src_ip": "193.163.125.16", "src_port": 46532, "dest_ip": "185.254.126.122", "dest_port": 19222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:19:25.272050+0100", "src_ip": "193.163.125.16", "dest_ip": "185.254.126.122", "src_port": 46532, "dest_port": 19222}}');
INSERT INTO alerts VALUES(441,1772983187.243932008,'{"timestamp": "2026-03-08T16:19:47.243932+0100", "flow_id": 1047681507445392, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59317, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 1928, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:19:47.243932+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59317, "dest_port": 53}}');
INSERT INTO alerts VALUES(442,1772983187.243932008,'{"timestamp": "2026-03-08T16:19:47.243932+0100", "flow_id": 1047683387832980, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 35279, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 13303, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:19:47.243932+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 35279, "dest_port": 53}}');
INSERT INTO alerts VALUES(443,1772983192.758270978,'{"timestamp": "2026-03-08T16:19:52.758271+0100", "flow_id": 160528073746398, "event_type": "alert", "src_ip": "167.94.146.34", "src_port": 43984, "dest_ip": "185.254.126.122", "dest_port": 41449, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:19:52.758271+0100", "src_ip": "167.94.146.34", "dest_ip": "185.254.126.122", "src_port": 43984, "dest_port": 41449}}');
INSERT INTO alerts VALUES(444,1772983327.290122986,'{"timestamp": "2026-03-08T16:22:07.290123+0100", "flow_id": 2090494553513625, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 36016, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 31813, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:22:07.290123+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 36016, "dest_port": 53}}');
INSERT INTO alerts VALUES(445,1772983327.290599108,'{"timestamp": "2026-03-08T16:22:07.290599+0100", "flow_id": 2092540515724860, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 43935, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 63730, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:22:07.290599+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 43935, "dest_port": 53}}');
INSERT INTO alerts VALUES(446,1772983466.492854118,'{"timestamp": "2026-03-08T16:24:26.492854+0100", "flow_id": 709417954493710, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 57705, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 3477, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:24:26.492854+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 57705, "dest_port": 53}}');
INSERT INTO alerts VALUES(447,1772983481.520857095,'{"timestamp": "2026-03-08T16:24:41.520857+0100", "flow_id": 490540381332187, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 34632, "dest_ip": "94.130.164.126", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053282, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "ts_progress": "client_hello_done", "tc_progress": "server_in_progress", "tls": {"sni": "relays.syncthing.net", "version": "TLS 1.3", "ja3": {"hash": "473cd7cb9faa642487833865d516e578", "string": "771,49195-49199-49196-49200-52393-52392-49161-49171-49162-49172-156-157-47-53-49170-10-4865-4866-4867,0-5-10-11-13-65281-18-43-51,29-23-24-25,0"}, "ja4": "t13d190900_9dc949149365_97f8aa674fd9"}, "app_proto": "tls", "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 1, "bytes_toserver": 432, "bytes_toclient": 60, "start": "2026-03-08T16:24:41.507428+0100", "src_ip": "192.168.2.16", "dest_ip": "94.130.164.126", "src_port": 34632, "dest_port": 443}}');
INSERT INTO alerts VALUES(448,1772983493.994020938,'{"timestamp": "2026-03-08T16:24:53.994021+0100", "flow_id": 1454538958475829, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 40157, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 37876, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:24:53.994021+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 40157, "dest_port": 53}}');
INSERT INTO alerts VALUES(449,1772983493.994874001,'{"timestamp": "2026-03-08T16:24:53.994874+0100", "flow_id": 1458204093888085, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 40417, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 1433, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:24:53.994874+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 40417, "dest_port": 53}}');
INSERT INTO alerts VALUES(450,1772983493.994874001,'{"timestamp": "2026-03-08T16:24:53.994874+0100", "flow_id": 1458203153664638, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 53667, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 58221, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:24:53.994874+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 53667, "dest_port": 53}}');
INSERT INTO alerts VALUES(451,1772983509.603434085,'{"timestamp": "2026-03-08T16:25:09.603434+0100", "flow_id": 1465830021168698, "event_type": "alert", "src_ip": "85.217.140.13", "src_port": 60039, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:25:09.603434+0100", "src_ip": "85.217.140.13", "dest_ip": "185.254.126.122", "src_port": 60039, "dest_port": 5432}}');
INSERT INTO alerts VALUES(452,1772983544.106472969,'{"timestamp": "2026-03-08T16:25:44.106473+0100", "flow_id": 175823174883444, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 14382, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:25:44.106473+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 14382}}');
INSERT INTO alerts VALUES(453,1772983572.972450018,'{"timestamp": "2026-03-08T16:26:12.972450+0100", "flow_id": 1361893309862427, "event_type": "alert", "src_ip": "193.163.125.30", "src_port": 54460, "dest_ip": "185.254.126.122", "dest_port": 1801, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:26:12.972450+0100", "src_ip": "193.163.125.30", "dest_ip": "185.254.126.122", "src_port": 54460, "dest_port": 1801}}');
INSERT INTO alerts VALUES(454,1772983581.66011095,'{"timestamp": "2026-03-08T16:26:21.660111+0100", "flow_id": 1427782223230921, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 42133, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:26:21.660111+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 42133, "dest_port": 3389}}');
INSERT INTO alerts VALUES(455,1772983630.504271984,'{"timestamp": "2026-03-08T16:27:10.504272+0100", "flow_id": 1884357145532917, "event_type": "alert", "src_ip": "167.94.138.98", "src_port": 9566, "dest_ip": "185.254.126.122", "dest_port": 43767, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:27:10.504272+0100", "src_ip": "167.94.138.98", "dest_ip": "185.254.126.122", "src_port": 9566, "dest_port": 43767}}');
INSERT INTO alerts VALUES(456,1772983643.422702075,'{"timestamp": "2026-03-08T16:27:23.422702+0100", "flow_id": 971068947125134, "event_type": "alert", "src_ip": "64.89.163.244", "src_port": 43516, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:27:23.422702+0100", "src_ip": "64.89.163.244", "dest_ip": "185.254.126.122", "src_port": 43516, "dest_port": 27017}}');
INSERT INTO alerts VALUES(457,1772983650.108805894,'{"timestamp": "2026-03-08T16:27:30.108806+0100", "flow_id": 748795235021661, "event_type": "alert", "src_ip": "91.196.152.20", "src_port": 53353, "dest_ip": "185.254.126.122", "dest_port": 2080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:27:30.108806+0100", "src_ip": "91.196.152.20", "dest_ip": "185.254.126.122", "src_port": 53353, "dest_port": 2080}}');
INSERT INTO alerts VALUES(458,1772983657.880790949,'{"timestamp": "2026-03-08T16:27:37.880791+0100", "flow_id": 405269963638629, "event_type": "alert", "src_ip": "176.65.134.34", "src_port": 53397, "dest_ip": "185.254.126.122", "dest_port": 40000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:27:37.880791+0100", "src_ip": "176.65.134.34", "dest_ip": "185.254.126.122", "src_port": 53397, "dest_port": 40000}}');
INSERT INTO alerts VALUES(459,1772983666.850575923,'{"timestamp": "2026-03-08T16:27:46.850576+0100", "flow_id": 838448564608170, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 43036, "dest_ip": "185.254.126.122", "dest_port": 9097, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:27:46.850576+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 43036, "dest_port": 9097}}');
INSERT INTO alerts VALUES(460,1772983671.504198075,'{"timestamp": "2026-03-08T16:27:51.504198+0100", "flow_id": 2165515840670180, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 55866, "dest_ip": "185.254.126.122", "dest_port": 11964, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:27:51.504198+0100", "src_ip": "167.94.146.42", "dest_ip": "185.254.126.122", "src_port": 55866, "dest_port": 11964}}');
INSERT INTO alerts VALUES(461,1772983684.054572105,'{"timestamp": "2026-03-08T16:28:04.054572+0100", "flow_id": 1360288157410758, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:28:04.054572+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2080}}');
INSERT INTO alerts VALUES(462,1772983684.054572105,'{"timestamp": "2026-03-08T16:28:04.054572+0100", "flow_id": 1360288157410758, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:28:04.054572+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2080}}');
INSERT INTO alerts VALUES(463,1772983715.16189003,'{"timestamp": "2026-03-08T16:28:35.161890+0100", "flow_id": 976788752273050, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3447, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:28:35.161890+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3447}}');
INSERT INTO alerts VALUES(464,1772983755.092349052,'{"timestamp": "2026-03-08T16:29:15.092349+0100", "flow_id": 959589416409074, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 43653, "dest_ip": "185.254.126.122", "dest_port": 71, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:29:15.092349+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 43653, "dest_port": 71}}');
INSERT INTO alerts VALUES(465,1772983836.755261899,'{"timestamp": "2026-03-08T16:30:36.755262+0100", "flow_id": 1273501191537648, "event_type": "alert", "src_ip": "117.40.159.18", "src_port": 54793, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:30:36.755262+0100", "src_ip": "117.40.159.18", "dest_ip": "185.254.126.122", "src_port": 54793, "dest_port": 1433}}');
INSERT INTO alerts VALUES(466,1772983842.878675938,'{"timestamp": "2026-03-08T16:30:42.878676+0100", "flow_id": 677662959913846, "event_type": "alert", "src_ip": "178.16.52.218", "src_port": 40798, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:30:42.878676+0100", "src_ip": "178.16.52.218", "dest_ip": "185.254.126.122", "src_port": 40798, "dest_port": 443}}');
INSERT INTO alerts VALUES(467,1772983854.827991963,'{"timestamp": "2026-03-08T16:30:54.827992+0100", "flow_id": 1867350179979252, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 41340, "dest_ip": "185.254.126.122", "dest_port": 587, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:30:54.827992+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 41340, "dest_port": 587}}');
INSERT INTO alerts VALUES(468,1772983877.221784114,'{"timestamp": "2026-03-08T16:31:17.221784+0100", "flow_id": 1515509212608294, "event_type": "alert", "src_ip": "167.94.146.65", "src_port": 36649, "dest_ip": "185.254.126.122", "dest_port": 16982, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:31:17.221784+0100", "src_ip": "167.94.146.65", "dest_ip": "185.254.126.122", "src_port": 36649, "dest_port": 16982}}');
INSERT INTO alerts VALUES(469,1772983909.313740969,'{"timestamp": "2026-03-08T16:31:49.313741+0100", "flow_id": 1628984434743085, "event_type": "alert", "src_ip": "130.12.180.65", "src_port": 58231, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:31:49.313741+0100", "src_ip": "130.12.180.65", "dest_ip": "185.254.126.122", "src_port": 58231, "dest_port": 5555}}');
INSERT INTO alerts VALUES(470,1772983909.313740969,'{"timestamp": "2026-03-08T16:31:49.313741+0100", "flow_id": 1628984434743085, "event_type": "alert", "src_ip": "130.12.180.65", "src_port": 58231, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:31:49.313741+0100", "src_ip": "130.12.180.65", "dest_ip": "185.254.126.122", "src_port": 58231, "dest_port": 5555}}');
INSERT INTO alerts VALUES(471,1772983938.554352046,'{"timestamp": "2026-03-08T16:32:18.554352+0100", "flow_id": 692075385005553, "event_type": "alert", "src_ip": "147.185.132.241", "src_port": 57300, "dest_ip": "185.254.126.122", "dest_port": 65529, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:32:18.554352+0100", "src_ip": "147.185.132.241", "dest_ip": "185.254.126.122", "src_port": 57300, "dest_port": 65529}}');
INSERT INTO alerts VALUES(472,1772984022.269624948,'{"timestamp": "2026-03-08T16:33:42.269625+0100", "flow_id": 1720983614622157, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 27787, "dest_ip": "185.254.126.122", "dest_port": 20264, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:33:42.269625+0100", "src_ip": "167.94.146.46", "dest_ip": "185.254.126.122", "src_port": 27787, "dest_port": 20264}}');
INSERT INTO alerts VALUES(473,1772984057.322400093,'{"timestamp": "2026-03-08T16:34:17.322400+0100", "flow_id": 540274483024759, "event_type": "alert", "src_ip": "167.94.138.151", "src_port": 16312, "dest_ip": "185.254.126.122", "dest_port": 2456, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:34:17.322400+0100", "src_ip": "167.94.138.151", "dest_ip": "185.254.126.122", "src_port": 16312, "dest_port": 2456}}');
INSERT INTO alerts VALUES(474,1772984075.039175987,'{"timestamp": "2026-03-08T16:34:35.039176+0100", "flow_id": 1012688685913352, "event_type": "alert", "src_ip": "91.196.152.156", "src_port": 19577, "dest_ip": "185.254.126.122", "dest_port": 55443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:34:35.039176+0100", "src_ip": "91.196.152.156", "dest_ip": "185.254.126.122", "src_port": 19577, "dest_port": 55443}}');
INSERT INTO alerts VALUES(475,1772984173.15208006,'{"timestamp": "2026-03-08T16:36:13.152080+0100", "flow_id": 1497605465607160, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 43123, "dest_ip": "185.254.126.122", "dest_port": 21906, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:36:13.152080+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 43123, "dest_port": 21906}}');
INSERT INTO alerts VALUES(476,1772984243.760792971,'{"timestamp": "2026-03-08T16:37:23.760793+0100", "flow_id": 1015784818253085, "event_type": "alert", "src_ip": "147.185.132.44", "src_port": 55057, "dest_ip": "185.254.126.122", "dest_port": 28009, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:37:23.760793+0100", "src_ip": "147.185.132.44", "dest_ip": "185.254.126.122", "src_port": 55057, "dest_port": 28009}}');
INSERT INTO alerts VALUES(477,1772984272.033152103,'{"timestamp": "2026-03-08T16:37:52.033152+0100", "flow_id": 142390535535138, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 8000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:37:52.033152+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 8000}}');
INSERT INTO alerts VALUES(478,1772984367.719733954,'{"timestamp": "2026-03-08T16:39:27.719734+0100", "flow_id": 2246810946611821, "event_type": "alert", "src_ip": "167.94.138.107", "src_port": 2602, "dest_ip": "185.254.126.122", "dest_port": 13202, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:39:27.719734+0100", "src_ip": "167.94.138.107", "dest_ip": "185.254.126.122", "src_port": 2602, "dest_port": 13202}}');
INSERT INTO alerts VALUES(479,1772984375.429728031,'{"timestamp": "2026-03-08T16:39:35.429728+0100", "flow_id": 2127144414309605, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 57816, "dest_ip": "185.254.126.122", "dest_port": 22222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:39:35.429728+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 57816, "dest_port": 22222}}');
INSERT INTO alerts VALUES(480,1772984497.230559111,'{"timestamp": "2026-03-08T16:41:37.230559+0100", "flow_id": 427293491306551, "event_type": "alert", "src_ip": "185.156.73.181", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 9444, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:41:37.230559+0100", "src_ip": "185.156.73.181", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 9444}}');
INSERT INTO alerts VALUES(481,1772984611.955027104,'{"timestamp": "2026-03-08T16:43:31.955027+0100", "flow_id": 1005586561665684, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 41362, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:43:31.955027+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 41362, "dest_port": 8080}}');
INSERT INTO alerts VALUES(482,1772984648.190538884,'{"timestamp": "2026-03-08T16:44:08.190539+0100", "flow_id": 255411237477906, "event_type": "alert", "src_ip": "176.65.139.46", "src_port": 59949, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:44:08.190539+0100", "src_ip": "176.65.139.46", "dest_ip": "185.254.126.122", "src_port": 59949, "dest_port": 23}}');
INSERT INTO alerts VALUES(483,1772984746.732268095,'{"timestamp": "2026-03-08T16:45:46.732268+0100", "flow_id": 611795875234246, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 41416, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 47671, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:45:46.732268+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 41416, "dest_port": 53}}');
INSERT INTO alerts VALUES(484,1772984746.733058929,'{"timestamp": "2026-03-08T16:45:46.733059+0100", "flow_id": 615190894534619, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 37924, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 33850, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:45:46.733059+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 37924, "dest_port": 53}}');
INSERT INTO alerts VALUES(485,1772984751.175523043,'{"timestamp": "2026-03-08T16:45:51.175523+0100", "flow_id": 2161240942577694, "event_type": "alert", "src_ip": "45.156.87.91", "src_port": 56716, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T16:45:51.175523+0100", "src_ip": "45.156.87.91", "dest_ip": "185.254.126.122", "src_port": 56716, "dest_port": 8080}}');
INSERT INTO alerts VALUES(486,1772984763.10732007,'{"timestamp": "2026-03-08T16:46:03.107320+0100", "flow_id": 1023889040145372, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 38355, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 59018, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:46:03.107320+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 38355, "dest_port": 53}}');
INSERT INTO alerts VALUES(487,1772984763.107321024,'{"timestamp": "2026-03-08T16:46:03.107321+0100", "flow_id": 1023893575620540, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 54325, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 62797, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:46:03.107321+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 54325, "dest_port": 53}}');
INSERT INTO alerts VALUES(488,1772984763.294047118,'{"timestamp": "2026-03-08T16:46:03.294047+0100", "flow_id": 981447365254387, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 33250, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 28653, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-08T16:46:03.294047+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 33250, "dest_port": 53}}');
INSERT INTO alerts VALUES(489,1772984844.709384919,'{"timestamp": "2026-03-08T16:47:24.709385+0100", "flow_id": 1357939193647459, "event_type": "alert", "src_ip": "91.196.152.44", "src_port": 26843, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:47:24.709385+0100", "src_ip": "91.196.152.44", "dest_ip": "185.254.126.122", "src_port": 26843, "dest_port": 53}}');
INSERT INTO alerts VALUES(490,1772984845.280729056,'{"timestamp": "2026-03-08T16:47:25.280729+0100", "flow_id": 1487199445022307, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 61453, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:47:25.280729+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 61453}}');
INSERT INTO alerts VALUES(491,1772984845.280729056,'{"timestamp": "2026-03-08T16:47:25.280729+0100", "flow_id": 1487199445022307, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 61453, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:47:25.280729+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 61453}}');
INSERT INTO alerts VALUES(492,1772984845.604773045,'{"timestamp": "2026-03-08T16:47:25.604773+0100", "flow_id": 1471583418366983, "event_type": "alert", "src_ip": "185.94.111.1", "src_port": 47023, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 61, "bytes_toclient": 0, "start": "2026-03-08T16:47:25.604773+0100", "src_ip": "185.94.111.1", "dest_ip": "185.254.126.122", "src_port": 47023, "dest_port": 161}}');
INSERT INTO alerts VALUES(493,1772984863.947989941,'{"timestamp": "2026-03-08T16:47:43.947990+0100", "flow_id": 2101263352202529, "event_type": "alert", "src_ip": "205.210.31.132", "src_port": 52947, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:47:43.947990+0100", "src_ip": "205.210.31.132", "dest_ip": "185.254.126.122", "src_port": 52947, "dest_port": 5432}}');
INSERT INTO alerts VALUES(494,1772984863.947989941,'{"timestamp": "2026-03-08T16:47:43.947990+0100", "flow_id": 2101263352202529, "event_type": "alert", "src_ip": "205.210.31.132", "src_port": 52947, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:47:43.947990+0100", "src_ip": "205.210.31.132", "dest_ip": "185.254.126.122", "src_port": 52947, "dest_port": 5432}}');
INSERT INTO alerts VALUES(495,1772984870.335284949,'{"timestamp": "2026-03-08T16:47:50.335285+0100", "flow_id": 1721516847082093, "event_type": "alert", "src_ip": "193.163.125.29", "src_port": 41636, "dest_ip": "185.254.126.122", "dest_port": 30005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:47:50.335285+0100", "src_ip": "193.163.125.29", "dest_ip": "185.254.126.122", "src_port": 41636, "dest_port": 30005}}');
INSERT INTO alerts VALUES(496,1772984870.800051928,'{"timestamp": "2026-03-08T16:47:50.800052+0100", "flow_id": 1747349447680093, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 49114, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:47:50.800052+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 49114, "dest_port": 8332}}');
INSERT INTO alerts VALUES(497,1772984870.800051928,'{"timestamp": "2026-03-08T16:47:50.800052+0100", "flow_id": 1747349447680093, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 49114, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:47:50.800052+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 49114, "dest_port": 8332}}');
INSERT INTO alerts VALUES(498,1772984886.791811943,'{"timestamp": "2026-03-08T16:48:06.791812+0100", "flow_id": 1711960166613676, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 60838, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 18536, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:48:06.791812+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 60838, "dest_port": 53}}');
INSERT INTO alerts VALUES(499,1772984886.791811943,'{"timestamp": "2026-03-08T16:48:06.791812+0100", "flow_id": 1711958716474617, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 53860, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 30282, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:48:06.791812+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 53860, "dest_port": 53}}');
INSERT INTO alerts VALUES(500,1772985026.853801012,'{"timestamp": "2026-03-08T16:50:26.853801+0100", "flow_id": 570826508932384, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 55064, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 24898, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:50:26.853801+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 55064, "dest_port": 53}}');
INSERT INTO alerts VALUES(501,1772985026.853801012,'{"timestamp": "2026-03-08T16:50:26.853801+0100", "flow_id": 570823973247065, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 33636, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 14034, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-08T16:50:26.853801+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 33636, "dest_port": 53}}');
INSERT INTO alerts VALUES(502,1772985076.927608967,'{"timestamp": "2026-03-08T16:51:16.927609+0100", "flow_id": 1169300840297615, "event_type": "alert", "src_ip": "91.196.152.12", "src_port": 47150, "dest_ip": "185.254.126.122", "dest_port": 2095, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T16:51:16.927609+0100", "src_ip": "91.196.152.12", "dest_ip": "185.254.126.122", "src_port": 47150, "dest_port": 2095}}');
INSERT INTO alerts VALUES(503,1772985132.016962051,'{"timestamp": "2026-03-08T16:52:12.016962+0100", "flow_id": 1198753056931526, "event_type": "alert", "src_ip": "185.242.226.11", "src_port": 60011, "dest_ip": "185.254.126.122", "dest_port": 12268, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:52:12.016962+0100", "src_ip": "185.242.226.11", "dest_ip": "185.254.126.122", "src_port": 60011, "dest_port": 12268}}');
INSERT INTO alerts VALUES(504,1772985181.097464084,'{"timestamp": "2026-03-08T16:53:01.097464+0100", "flow_id": 1544505320349018, "event_type": "alert", "src_ip": "193.163.125.9", "src_port": 58376, "dest_ip": "185.254.126.122", "dest_port": 2112, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:53:01.097464+0100", "src_ip": "193.163.125.9", "dest_ip": "185.254.126.122", "src_port": 58376, "dest_port": 2112}}');
INSERT INTO alerts VALUES(505,1772985352.46607089,'{"timestamp": "2026-03-08T16:55:52.466071+0100", "flow_id": 31437781227380, "event_type": "alert", "src_ip": "193.163.125.11", "src_port": 47534, "dest_ip": "185.254.126.122", "dest_port": 104, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T16:55:52.466071+0100", "src_ip": "193.163.125.11", "dest_ip": "185.254.126.122", "src_port": 47534, "dest_port": 104}}');
INSERT INTO alerts VALUES(506,1772985418.183990956,'{"timestamp": "2026-03-08T16:56:58.183991+0100", "flow_id": 790238038850189, "event_type": "alert", "src_ip": "213.209.159.158", "src_port": 57602, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400060, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 61", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T16:56:58.183991+0100", "src_ip": "213.209.159.158", "dest_ip": "185.254.126.122", "src_port": 57602, "dest_port": 22}}');
INSERT INTO alerts VALUES(507,1772985635.792778015,'{"timestamp": "2026-03-08T17:00:35.792778+0100", "flow_id": 871684757101732, "event_type": "alert", "src_ip": "45.153.34.226", "src_port": 38092, "dest_ip": "185.254.126.122", "dest_port": 3328, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T17:00:35.792778+0100", "src_ip": "45.153.34.226", "dest_ip": "185.254.126.122", "src_port": 38092, "dest_port": 3328}}');
INSERT INTO alerts VALUES(508,1772985635.792778015,'{"timestamp": "2026-03-08T17:00:35.792778+0100", "flow_id": 871684757101732, "event_type": "alert", "src_ip": "45.153.34.226", "src_port": 38092, "dest_ip": "185.254.126.122", "dest_port": 3328, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500030, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 16", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T17:00:35.792778+0100", "src_ip": "45.153.34.226", "dest_ip": "185.254.126.122", "src_port": 38092, "dest_port": 3328}}');
INSERT INTO alerts VALUES(509,1772985804.399805069,'{"timestamp": "2026-03-08T17:03:24.399805+0100", "flow_id": 1154202378636500, "event_type": "alert", "src_ip": "88.210.63.192", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 64432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:03:24.399805+0100", "src_ip": "88.210.63.192", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 64432}}');
INSERT INTO alerts VALUES(510,1772985881.500466109,'{"timestamp": "2026-03-08T17:04:41.500466+0100", "flow_id": 460636328538988, "event_type": "alert", "src_ip": "45.194.92.56", "src_port": 39787, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:04:41.500466+0100", "src_ip": "45.194.92.56", "dest_ip": "185.254.126.122", "src_port": 39787, "dest_port": 8080}}');
INSERT INTO alerts VALUES(511,1772985895.110693931,'{"timestamp": "2026-03-08T17:04:55.110694+0100", "flow_id": 2164277069763005, "event_type": "alert", "src_ip": "167.94.138.99", "src_port": 60135, "dest_ip": "185.254.126.122", "dest_port": 31182, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:04:55.110694+0100", "src_ip": "167.94.138.99", "dest_ip": "185.254.126.122", "src_port": 60135, "dest_port": 31182}}');
INSERT INTO alerts VALUES(512,1772985951.181596041,'{"timestamp": "2026-03-08T17:05:51.181596+0100", "flow_id": 2187326930518817, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 46716, "dest_ip": "185.254.126.122", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:05:51.181596+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 46716, "dest_port": 3001}}');
INSERT INTO alerts VALUES(513,1772985974.768934965,'{"timestamp": "2026-03-08T17:06:14.768935+0100", "flow_id": 1895178490011227, "event_type": "alert", "src_ip": "91.230.168.108", "src_port": 43191, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:06:14.768935+0100", "src_ip": "91.230.168.108", "dest_ip": "185.254.126.122", "src_port": 43191, "dest_port": 1433}}');
INSERT INTO alerts VALUES(514,1772985988.192663908,'{"timestamp": "2026-03-08T17:06:28.192664+0100", "flow_id": 1390439411127155, "event_type": "alert", "src_ip": "198.235.24.227", "src_port": 50539, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:06:28.192664+0100", "src_ip": "198.235.24.227", "dest_ip": "185.254.126.122", "src_port": 50539, "dest_port": 5060}}');
INSERT INTO alerts VALUES(515,1772986131.379471064,'{"timestamp": "2026-03-08T17:08:51.379471+0100", "flow_id": 1066869836856356, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 58397, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:08:51.379471+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 58397, "dest_port": 80}}');
INSERT INTO alerts VALUES(516,1772986152.767803907,'{"timestamp": "2026-03-08T17:09:12.767804+0100", "flow_id": 201469669823368, "event_type": "alert", "src_ip": "193.163.125.20", "src_port": 42946, "dest_ip": "185.254.126.122", "dest_port": 1080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:09:12.767804+0100", "src_ip": "193.163.125.20", "dest_ip": "185.254.126.122", "src_port": 42946, "dest_port": 1080}}');
INSERT INTO alerts VALUES(517,1772986158.972491025,'{"timestamp": "2026-03-08T17:09:18.972491+0100", "flow_id": 1925018381297669, "event_type": "alert", "src_ip": "45.142.154.98", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 139, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:09:18.972491+0100", "src_ip": "45.142.154.98", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 139}}');
INSERT INTO alerts VALUES(518,1772986263.586312055,'{"timestamp": "2026-03-08T17:11:03.586312+0100", "flow_id": 2236715950949126, "event_type": "alert", "src_ip": "167.94.138.152", "src_port": 41740, "dest_ip": "185.254.126.122", "dest_port": 20548, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:11:03.586312+0100", "src_ip": "167.94.138.152", "dest_ip": "185.254.126.122", "src_port": 41740, "dest_port": 20548}}');
INSERT INTO alerts VALUES(519,1772986279.691457033,'{"timestamp": "2026-03-08T17:11:19.691457+0100", "flow_id": 2125362974157734, "event_type": "alert", "src_ip": "185.156.73.182", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 62000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:11:19.691457+0100", "src_ip": "185.156.73.182", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 62000}}');
INSERT INTO alerts VALUES(520,1772986417.062252999,'{"timestamp": "2026-03-08T17:13:37.062253+0100", "flow_id": 548849980893369, "event_type": "alert", "src_ip": "43.228.157.15", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:13:37.062253+0100", "src_ip": "43.228.157.15", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 23}}');
INSERT INTO alerts VALUES(521,1772986677.170263051,'{"timestamp": "2026-03-08T17:17:57.170263+0100", "flow_id": 1575702313068434, "event_type": "alert", "src_ip": "176.65.148.95", "src_port": 33173, "dest_ip": "185.254.126.122", "dest_port": 12345, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:17:57.170263+0100", "src_ip": "176.65.148.95", "dest_ip": "185.254.126.122", "src_port": 33173, "dest_port": 12345}}');
INSERT INTO alerts VALUES(522,1772986677.170263051,'{"timestamp": "2026-03-08T17:17:57.170263+0100", "flow_id": 1575702313068434, "event_type": "alert", "src_ip": "176.65.148.95", "src_port": 33173, "dest_ip": "185.254.126.122", "dest_port": 12345, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:17:57.170263+0100", "src_ip": "176.65.148.95", "dest_ip": "185.254.126.122", "src_port": 33173, "dest_port": 12345}}');
INSERT INTO alerts VALUES(523,1772986773.618047953,'{"timestamp": "2026-03-08T17:19:33.618048+0100", "flow_id": 1528599759614899, "event_type": "alert", "src_ip": "176.65.148.55", "src_port": 39337, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:19:33.618048+0100", "src_ip": "176.65.148.55", "dest_ip": "185.254.126.122", "src_port": 39337, "dest_port": 8080}}');
INSERT INTO alerts VALUES(524,1772986773.618047953,'{"timestamp": "2026-03-08T17:19:33.618048+0100", "flow_id": 1528599759614899, "event_type": "alert", "src_ip": "176.65.148.55", "src_port": 39337, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:19:33.618048+0100", "src_ip": "176.65.148.55", "dest_ip": "185.254.126.122", "src_port": 39337, "dest_port": 8080}}');
INSERT INTO alerts VALUES(525,1772986825.173356056,'{"timestamp": "2026-03-08T17:20:25.173356+0100", "flow_id": 463085884454150, "event_type": "alert", "src_ip": "79.124.62.178", "src_port": 56406, "dest_ip": "185.254.126.122", "dest_port": 3397, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:20:25.173356+0100", "src_ip": "79.124.62.178", "dest_ip": "185.254.126.122", "src_port": 56406, "dest_port": 3397}}');
INSERT INTO alerts VALUES(526,1772986847.175776004,'{"timestamp": "2026-03-08T17:20:47.175776+0100", "flow_id": 2162330757419835, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 44718, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:20:47.175776+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 44718, "dest_port": 22}}');
INSERT INTO alerts VALUES(527,1772986847.175776004,'{"timestamp": "2026-03-08T17:20:47.175776+0100", "flow_id": 2162330757419835, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 44718, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:20:47.175776+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 44718, "dest_port": 22}}');
INSERT INTO alerts VALUES(528,1772986875.989116908,'{"timestamp": "2026-03-08T17:21:15.989117+0100", "flow_id": 870527751277538, "event_type": "alert", "src_ip": "147.185.132.43", "src_port": 54917, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:21:15.989117+0100", "src_ip": "147.185.132.43", "dest_ip": "185.254.126.122", "src_port": 54917, "dest_port": 23}}');
INSERT INTO alerts VALUES(529,1772986884.069772959,'{"timestamp": "2026-03-08T17:21:24.069773+0100", "flow_id": 1144100433554644, "event_type": "alert", "src_ip": "167.94.138.154", "src_port": 65316, "dest_ip": "185.254.126.122", "dest_port": 6362, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:21:24.069773+0100", "src_ip": "167.94.138.154", "dest_ip": "185.254.126.122", "src_port": 65316, "dest_port": 6362}}');
INSERT INTO alerts VALUES(530,1772986903.932306052,'{"timestamp": "2026-03-08T17:21:43.932306+0100", "flow_id": 2033903009339874, "event_type": "alert", "src_ip": "167.94.138.109", "src_port": 8896, "dest_ip": "185.254.126.122", "dest_port": 38607, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:21:43.932306+0100", "src_ip": "167.94.138.109", "dest_ip": "185.254.126.122", "src_port": 8896, "dest_port": 38607}}');
INSERT INTO alerts VALUES(531,1772986910.993628978,'{"timestamp": "2026-03-08T17:21:50.993629+0100", "flow_id": 1734329929855982, "event_type": "alert", "src_ip": "185.156.73.180", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 33, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:21:50.993629+0100", "src_ip": "185.156.73.180", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 33}}');
INSERT INTO alerts VALUES(532,1772987011.133872033,'{"timestamp": "2026-03-08T17:23:31.133872+0100", "flow_id": 856453682475244, "event_type": "alert", "src_ip": "45.142.154.99", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 9999, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:23:31.133872+0100", "src_ip": "45.142.154.99", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 9999}}');
INSERT INTO alerts VALUES(533,1772987167.081490039,'{"timestamp": "2026-03-08T17:26:07.081490+0100", "flow_id": 2038847005226053, "event_type": "alert", "src_ip": "167.94.138.137", "src_port": 24203, "dest_ip": "185.254.126.122", "dest_port": 5672, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:26:07.081490+0100", "src_ip": "167.94.138.137", "dest_ip": "185.254.126.122", "src_port": 24203, "dest_port": 5672}}');
INSERT INTO alerts VALUES(534,1772987186.152793884,'{"timestamp": "2026-03-08T17:26:26.152794+0100", "flow_id": 656249351098835, "event_type": "alert", "src_ip": "176.65.139.31", "src_port": 61475, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 67, "bytes_toclient": 0, "start": "2026-03-08T17:26:26.152794+0100", "src_ip": "176.65.139.31", "dest_ip": "185.254.126.122", "src_port": 61475, "dest_port": 389}}');
INSERT INTO alerts VALUES(535,1772987256.545439004,'{"timestamp": "2026-03-08T17:27:36.545439+0100", "flow_id": 90846710140892, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 14306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:27:36.545439+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 14306}}');
INSERT INTO alerts VALUES(536,1772987258.981443881,'{"timestamp": "2026-03-08T17:27:38.981444+0100", "flow_id": 837573782271992, "event_type": "alert", "src_ip": "167.94.146.39", "src_port": 40595, "dest_ip": "185.254.126.122", "dest_port": 32045, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:27:38.981444+0100", "src_ip": "167.94.146.39", "dest_ip": "185.254.126.122", "src_port": 40595, "dest_port": 32045}}');
INSERT INTO alerts VALUES(537,1772987287.527376891,'{"timestamp": "2026-03-08T17:28:07.527377+0100", "flow_id": 1983592515889478, "event_type": "alert", "src_ip": "88.210.63.193", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 55, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:28:07.527377+0100", "src_ip": "88.210.63.193", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 55}}');
INSERT INTO alerts VALUES(538,1772987291.563910961,'{"timestamp": "2026-03-08T17:28:11.563911+0100", "flow_id": 1014604614574069, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 42117, "dest_ip": "185.254.126.122", "dest_port": 8612, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:28:11.563911+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 42117, "dest_port": 8612}}');
INSERT INTO alerts VALUES(539,1772987321.691730022,'{"timestamp": "2026-03-08T17:28:41.691730+0100", "flow_id": 437684056379201, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 48114, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T17:28:41.691730+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 48114, "dest_port": 8332}}');
INSERT INTO alerts VALUES(540,1772987321.691730022,'{"timestamp": "2026-03-08T17:28:41.691730+0100", "flow_id": 437684056379201, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 48114, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T17:28:41.691730+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 48114, "dest_port": 8332}}');
INSERT INTO alerts VALUES(541,1772987377.755420924,'{"timestamp": "2026-03-08T17:29:37.755421+0100", "flow_id": 429760179565612, "event_type": "alert", "src_ip": "193.163.125.37", "src_port": 41353, "dest_ip": "185.254.126.122", "dest_port": 1300, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:29:37.755421+0100", "src_ip": "193.163.125.37", "dest_ip": "185.254.126.122", "src_port": 41353, "dest_port": 1300}}');
INSERT INTO alerts VALUES(542,1772987412.914531946,'{"timestamp": "2026-03-08T17:30:12.914532+0100", "flow_id": 1394610302042271, "event_type": "alert", "src_ip": "64.89.163.97", "src_port": 47426, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:30:12.914532+0100", "src_ip": "64.89.163.97", "dest_ip": "185.254.126.122", "src_port": 47426, "dest_port": 3306}}');
INSERT INTO alerts VALUES(543,1772987412.914531946,'{"timestamp": "2026-03-08T17:30:12.914532+0100", "flow_id": 1394610302042271, "event_type": "alert", "src_ip": "64.89.163.97", "src_port": 47426, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:30:12.914532+0100", "src_ip": "64.89.163.97", "dest_ip": "185.254.126.122", "src_port": 47426, "dest_port": 3306}}');
INSERT INTO alerts VALUES(544,1772987478.527916908,'{"timestamp": "2026-03-08T17:31:18.527917+0100", "flow_id": 1704438498143800, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 43036, "dest_ip": "185.254.126.122", "dest_port": 63186, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:31:18.527917+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 43036, "dest_port": 63186}}');
INSERT INTO alerts VALUES(545,1772987527.055741072,'{"timestamp": "2026-03-08T17:32:07.055741+0100", "flow_id": 2209734552843701, "event_type": "alert", "src_ip": "46.19.137.194", "src_port": 48453, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:32:07.055741+0100", "src_ip": "46.19.137.194", "dest_ip": "185.254.126.122", "src_port": 48453, "dest_port": 5432}}');
INSERT INTO alerts VALUES(546,1772987539.156482934,'{"timestamp": "2026-03-08T17:32:19.156483+0100", "flow_id": 953567712418953, "event_type": "alert", "src_ip": "193.163.125.27", "src_port": 33433, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:32:19.156483+0100", "src_ip": "193.163.125.27", "dest_ip": "185.254.126.122", "src_port": 33433, "dest_port": 27017}}');
INSERT INTO alerts VALUES(547,1772987542.40350008,'{"timestamp": "2026-03-08T17:32:22.403500+0100", "flow_id": 1733021780739585, "event_type": "alert", "src_ip": "193.163.125.4", "src_port": 50999, "dest_ip": "185.254.126.122", "dest_port": 10115, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:32:22.403500+0100", "src_ip": "193.163.125.4", "dest_ip": "185.254.126.122", "src_port": 50999, "dest_port": 10115}}');
INSERT INTO alerts VALUES(548,1772987582.248450995,'{"timestamp": "2026-03-08T17:33:02.248451+0100", "flow_id": 1911516171293268, "event_type": "alert", "src_ip": "102.53.12.221", "src_port": 54015, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:33:02.248451+0100", "src_ip": "102.53.12.221", "dest_ip": "185.254.126.122", "src_port": 54015, "dest_port": 1433}}');
INSERT INTO alerts VALUES(549,1772987728.901315927,'{"timestamp": "2026-03-08T17:35:28.901316+0100", "flow_id": 211950452284474, "event_type": "alert", "src_ip": "91.196.152.28", "src_port": 57030, "dest_ip": "185.254.126.122", "dest_port": 24442, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:35:28.901316+0100", "src_ip": "91.196.152.28", "dest_ip": "185.254.126.122", "src_port": 57030, "dest_port": 24442}}');
INSERT INTO alerts VALUES(550,1772987758.450225115,'{"timestamp": "2026-03-08T17:35:58.450225+0100", "flow_id": 1933701951331983, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 1609, "dest_ip": "185.254.126.122", "dest_port": 56746, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:35:58.450225+0100", "src_ip": "167.94.146.38", "dest_ip": "185.254.126.122", "src_port": 1609, "dest_port": 56746}}');
INSERT INTO alerts VALUES(551,1772987808.139030934,'{"timestamp": "2026-03-08T17:36:48.139031+0100", "flow_id": 34187210940472, "event_type": "alert", "src_ip": "176.120.22.135", "src_port": 50979, "dest_ip": "185.254.126.122", "dest_port": 5405, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:36:48.139031+0100", "src_ip": "176.120.22.135", "dest_ip": "185.254.126.122", "src_port": 50979, "dest_port": 5405}}');
INSERT INTO alerts VALUES(552,1772987875.393194914,'{"timestamp": "2026-03-08T17:37:55.393195+0100", "flow_id": 1125810053581051, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 56511, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:37:55.393195+0100", "src_ip": "45.156.87.127", "dest_ip": "185.254.126.122", "src_port": 56511, "dest_port": 3306}}');
INSERT INTO alerts VALUES(553,1772987875.393194914,'{"timestamp": "2026-03-08T17:37:55.393195+0100", "flow_id": 1125810053581051, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 56511, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:37:55.393195+0100", "src_ip": "45.156.87.127", "dest_ip": "185.254.126.122", "src_port": 56511, "dest_port": 3306}}');
INSERT INTO alerts VALUES(554,1772987966.420342923,'{"timestamp": "2026-03-08T17:39:26.420343+0100", "flow_id": 1805363210431817, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3431, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:39:26.420343+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3431}}');
INSERT INTO alerts VALUES(555,1772988074.489778041,'{"timestamp": "2026-03-08T17:41:14.489778+0100", "flow_id": 696208800040104, "event_type": "alert", "src_ip": "64.89.161.182", "src_port": 38494, "dest_ip": "185.254.126.122", "dest_port": 63938, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T17:41:14.489778+0100", "src_ip": "64.89.161.182", "dest_ip": "185.254.126.122", "src_port": 38494, "dest_port": 63938}}');
INSERT INTO alerts VALUES(556,1772988151.078849077,'{"timestamp": "2026-03-08T17:42:31.078849+0100", "flow_id": 2027506143826378, "event_type": "alert", "src_ip": "147.185.132.144", "src_port": 51778, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:42:31.078849+0100", "src_ip": "147.185.132.144", "dest_ip": "185.254.126.122", "src_port": 51778, "dest_port": 3306}}');
INSERT INTO alerts VALUES(557,1772988151.078849077,'{"timestamp": "2026-03-08T17:42:31.078849+0100", "flow_id": 2027506143826378, "event_type": "alert", "src_ip": "147.185.132.144", "src_port": 51778, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:42:31.078849+0100", "src_ip": "147.185.132.144", "dest_ip": "185.254.126.122", "src_port": 51778, "dest_port": 3306}}');
INSERT INTO alerts VALUES(558,1772988206.581197024,'{"timestamp": "2026-03-08T17:43:26.581197+0100", "flow_id": 1933272332946708, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 43653, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:43:26.581197+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 43653, "dest_port": 3389}}');
INSERT INTO alerts VALUES(559,1772988372.851629019,'{"timestamp": "2026-03-08T17:46:12.851629+0100", "flow_id": 1405921388664115, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 34090, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:46:12.851629+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 34090, "dest_port": 23}}');
INSERT INTO alerts VALUES(560,1772988372.851629019,'{"timestamp": "2026-03-08T17:46:12.851629+0100", "flow_id": 1405921388664115, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 34090, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:46:12.851629+0100", "src_ip": "130.12.180.174", "dest_ip": "185.254.126.122", "src_port": 34090, "dest_port": 23}}');
INSERT INTO alerts VALUES(561,1772988431.939208984,'{"timestamp": "2026-03-08T17:47:11.939209+0100", "flow_id": 2063551309477785, "event_type": "alert", "src_ip": "185.242.3.196", "src_port": 55883, "dest_ip": "185.254.126.122", "dest_port": 4096, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:47:11.939209+0100", "src_ip": "185.242.3.196", "dest_ip": "185.254.126.122", "src_port": 55883, "dest_port": 4096}}');
INSERT INTO alerts VALUES(562,1772988491.464519977,'{"timestamp": "2026-03-08T17:48:11.464520+0100", "flow_id": 869198948798961, "event_type": "alert", "src_ip": "193.163.125.16", "src_port": 40199, "dest_ip": "185.254.126.122", "dest_port": 8019, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:48:11.464520+0100", "src_ip": "193.163.125.16", "dest_ip": "185.254.126.122", "src_port": 40199, "dest_port": 8019}}');
INSERT INTO alerts VALUES(563,1772988502.369503975,'{"timestamp": "2026-03-08T17:48:22.369504+0100", "flow_id": 1868482737008161, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 28143, "dest_ip": "185.254.126.122", "dest_port": 26935, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:48:22.369504+0100", "src_ip": "167.94.146.42", "dest_ip": "185.254.126.122", "src_port": 28143, "dest_port": 26935}}');
INSERT INTO alerts VALUES(564,1772988571.656270981,'{"timestamp": "2026-03-08T17:49:31.656271+0100", "flow_id": 848338912696795, "event_type": "alert", "src_ip": "167.94.146.74", "src_port": 21645, "dest_ip": "185.254.126.122", "dest_port": 40511, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:49:31.656271+0100", "src_ip": "167.94.146.74", "dest_ip": "185.254.126.122", "src_port": 21645, "dest_port": 40511}}');
INSERT INTO alerts VALUES(565,1772988585.328767061,'{"timestamp": "2026-03-08T17:49:45.328767+0100", "flow_id": 286146540968300, "event_type": "alert", "src_ip": "193.163.125.6", "src_port": 40451, "dest_ip": "185.254.126.122", "dest_port": 873, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:49:45.328767+0100", "src_ip": "193.163.125.6", "dest_ip": "185.254.126.122", "src_port": 40451, "dest_port": 873}}');
INSERT INTO alerts VALUES(566,1772988587.642457009,'{"timestamp": "2026-03-08T17:49:47.642457+0100", "flow_id": 1070482176849571, "event_type": "alert", "src_ip": "167.94.146.34", "src_port": 26885, "dest_ip": "185.254.126.122", "dest_port": 8558, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:49:47.642457+0100", "src_ip": "167.94.146.34", "dest_ip": "185.254.126.122", "src_port": 26885, "dest_port": 8558}}');
INSERT INTO alerts VALUES(567,1772988595.453537941,'{"timestamp": "2026-03-08T17:49:55.453538+0100", "flow_id": 1103510121394297, "event_type": "alert", "src_ip": "205.210.31.196", "src_port": 54086, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:49:55.453538+0100", "src_ip": "205.210.31.196", "dest_ip": "185.254.126.122", "src_port": 54086, "dest_port": 3389}}');
INSERT INTO alerts VALUES(568,1772988627.957986116,'{"timestamp": "2026-03-08T17:50:27.957986+0100", "flow_id": 1018297424414785, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "185.254.126.122", "dest_port": 19133, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 61, "bytes_toclient": 0, "start": "2026-03-08T17:50:27.957986+0100", "src_ip": "204.76.203.17", "dest_ip": "185.254.126.122", "src_port": 47534, "dest_port": 19133}}');
INSERT INTO alerts VALUES(569,1772988627.957986116,'{"timestamp": "2026-03-08T17:50:27.957986+0100", "flow_id": 1018297424414785, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "185.254.126.122", "dest_port": 19133, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 61, "bytes_toclient": 0, "start": "2026-03-08T17:50:27.957986+0100", "src_ip": "204.76.203.17", "dest_ip": "185.254.126.122", "src_port": 47534, "dest_port": 19133}}');
INSERT INTO alerts VALUES(570,1772988676.434536934,'{"timestamp": "2026-03-08T17:51:16.434537+0100", "flow_id": 1303376461237583, "event_type": "alert", "src_ip": "205.210.31.102", "src_port": 50583, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:51:16.434537+0100", "src_ip": "205.210.31.102", "dest_ip": "185.254.126.122", "src_port": 50583, "dest_port": 22}}');
INSERT INTO alerts VALUES(571,1772988684.095103025,'{"timestamp": "2026-03-08T17:51:24.095103+0100", "flow_id": 1252892792042001, "event_type": "alert", "src_ip": "193.163.125.10", "src_port": 51549, "dest_ip": "185.254.126.122", "dest_port": 11102, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:51:24.095103+0100", "src_ip": "193.163.125.10", "dest_ip": "185.254.126.122", "src_port": 51549, "dest_port": 11102}}');
INSERT INTO alerts VALUES(572,1772988771.546667098,'{"timestamp": "2026-03-08T17:52:51.546667+0100", "flow_id": 940544678170436, "event_type": "alert", "src_ip": "193.32.162.196", "src_port": 42354, "dest_ip": "185.254.126.122", "dest_port": 25, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T17:52:51.546667+0100", "src_ip": "193.32.162.196", "dest_ip": "185.254.126.122", "src_port": 42354, "dest_port": 25}}');
INSERT INTO alerts VALUES(573,1772988843.922080039,'{"timestamp": "2026-03-08T17:54:03.922080+0100", "flow_id": 864081400988469, "event_type": "alert", "src_ip": "167.94.138.155", "src_port": 11449, "dest_ip": "185.254.126.122", "dest_port": 1604, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 58, "bytes_toclient": 0, "start": "2026-03-08T17:54:03.922080+0100", "src_ip": "167.94.138.155", "dest_ip": "185.254.126.122", "src_port": 11449, "dest_port": 1604}}');
INSERT INTO alerts VALUES(574,1772988883.654165029,'{"timestamp": "2026-03-08T17:54:43.654165+0100", "flow_id": 1120769085111801, "event_type": "alert", "src_ip": "167.94.146.75", "src_port": 1645, "dest_ip": "185.254.126.122", "dest_port": 56813, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:54:43.654165+0100", "src_ip": "167.94.146.75", "dest_ip": "185.254.126.122", "src_port": 1645, "dest_port": 56813}}');
INSERT INTO alerts VALUES(575,1772988977.131236077,'{"timestamp": "2026-03-08T17:56:17.131236+0100", "flow_id": 282181606566428, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 44991, "dest_ip": "185.254.126.122", "dest_port": 48526, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:56:17.131236+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 44991, "dest_port": 48526}}');
INSERT INTO alerts VALUES(576,1772988983.968255043,'{"timestamp": "2026-03-08T17:56:23.968255+0100", "flow_id": 2188298944658028, "event_type": "alert", "src_ip": "205.210.31.201", "src_port": 50682, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:56:23.968255+0100", "src_ip": "205.210.31.201", "dest_ip": "185.254.126.122", "src_port": 50682, "dest_port": 1433}}');
INSERT INTO alerts VALUES(577,1772988983.968255043,'{"timestamp": "2026-03-08T17:56:23.968255+0100", "flow_id": 2188298944658028, "event_type": "alert", "src_ip": "205.210.31.201", "src_port": 50682, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:56:23.968255+0100", "src_ip": "205.210.31.201", "dest_ip": "185.254.126.122", "src_port": 50682, "dest_port": 1433}}');
INSERT INTO alerts VALUES(578,1772988991.803847075,'{"timestamp": "2026-03-08T17:56:31.803847+0100", "flow_id": 2045124383443051, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 18986, "dest_ip": "185.254.126.122", "dest_port": 32265, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:56:31.803847+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 18986, "dest_port": 32265}}');
INSERT INTO alerts VALUES(579,1772989016.04788208,'{"timestamp": "2026-03-08T17:56:56.047882+0100", "flow_id": 205652349794823, "event_type": "alert", "src_ip": "193.163.125.18", "src_port": 44478, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T17:56:56.047882+0100", "src_ip": "193.163.125.18", "dest_ip": "185.254.126.122", "src_port": 44478, "dest_port": 161}}');
INSERT INTO alerts VALUES(580,1772989101.350774049,'{"timestamp": "2026-03-08T17:58:21.350774+0100", "flow_id": 1506563633969297, "event_type": "alert", "src_ip": "167.94.138.151", "src_port": 7678, "dest_ip": "185.254.126.122", "dest_port": 5984, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:58:21.350774+0100", "src_ip": "167.94.138.151", "dest_ip": "185.254.126.122", "src_port": 7678, "dest_port": 5984}}');
INSERT INTO alerts VALUES(581,1772989136.980010032,'{"timestamp": "2026-03-08T17:58:56.980010+0100", "flow_id": 268462644535775, "event_type": "alert", "src_ip": "167.94.138.132", "src_port": 51667, "dest_ip": "185.254.126.122", "dest_port": 61616, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:58:56.980010+0100", "src_ip": "167.94.138.132", "dest_ip": "185.254.126.122", "src_port": 51667, "dest_port": 61616}}');
INSERT INTO alerts VALUES(582,1772989155.397876024,'{"timestamp": "2026-03-08T17:59:15.397876+0100", "flow_id": 864441343097470, "event_type": "alert", "src_ip": "167.94.146.33", "src_port": 19261, "dest_ip": "185.254.126.122", "dest_port": 38230, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T17:59:15.397876+0100", "src_ip": "167.94.146.33", "dest_ip": "185.254.126.122", "src_port": 19261, "dest_port": 38230}}');
INSERT INTO alerts VALUES(583,1772989285.164907933,'{"timestamp": "2026-03-08T18:01:25.164908+0100", "flow_id": 1552700395247823, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:01:25.164908+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2082}}');
INSERT INTO alerts VALUES(584,1772989285.164907933,'{"timestamp": "2026-03-08T18:01:25.164908+0100", "flow_id": 1552700395247823, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:01:25.164908+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2082}}');
INSERT INTO alerts VALUES(585,1772989546.363516093,'{"timestamp": "2026-03-08T18:05:46.363516+0100", "flow_id": 716866880513402, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 4432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:05:46.363516+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 4432}}');
INSERT INTO alerts VALUES(586,1772989670.375839949,'{"timestamp": "2026-03-08T18:07:50.375840+0100", "flow_id": 1895696493921892, "event_type": "alert", "src_ip": "193.163.125.31", "src_port": 43741, "dest_ip": "185.254.126.122", "dest_port": 1040, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:07:50.375840+0100", "src_ip": "193.163.125.31", "dest_ip": "185.254.126.122", "src_port": 43741, "dest_port": 1040}}');
INSERT INTO alerts VALUES(587,1772989772.169823885,'{"timestamp": "2026-03-08T18:09:32.169824+0100", "flow_id": 1292339053044915, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 14355, "dest_ip": "185.254.126.122", "dest_port": 44979, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T18:09:32.169824+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 14355, "dest_port": 44979}}');
INSERT INTO alerts VALUES(588,1772989858.058634042,'{"timestamp": "2026-03-08T18:10:58.058634+0100", "flow_id": 814781961384633, "event_type": "alert", "src_ip": "87.121.84.67", "src_port": 56579, "dest_ip": "185.254.126.122", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:10:58.058634+0100", "src_ip": "87.121.84.67", "dest_ip": "185.254.126.122", "src_port": 56579, "dest_port": 5900}}');
INSERT INTO alerts VALUES(589,1772990360.712070941,'{"timestamp": "2026-03-08T18:19:20.712071+0100", "flow_id": 243572377181667, "event_type": "alert", "src_ip": "193.163.125.15", "src_port": 51796, "dest_ip": "185.254.126.122", "dest_port": 5375, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:19:20.712071+0100", "src_ip": "193.163.125.15", "dest_ip": "185.254.126.122", "src_port": 51796, "dest_port": 5375}}');
INSERT INTO alerts VALUES(590,1772990370.327887059,'{"timestamp": "2026-03-08T18:19:30.327887+0100", "flow_id": 563843169949282, "event_type": "alert", "src_ip": "167.94.146.47", "src_port": 34615, "dest_ip": "185.254.126.122", "dest_port": 64727, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T18:19:30.327887+0100", "src_ip": "167.94.146.47", "dest_ip": "185.254.126.122", "src_port": 34615, "dest_port": 64727}}');
INSERT INTO alerts VALUES(591,1772990399.321908951,'{"timestamp": "2026-03-08T18:19:59.321909+0100", "flow_id": 2227017267385765, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 60386, "dest_ip": "185.254.126.122", "dest_port": 4001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:19:59.321909+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 60386, "dest_port": 4001}}');
INSERT INTO alerts VALUES(592,1772990432.730726957,'{"timestamp": "2026-03-08T18:20:32.730727+0100", "flow_id": 42224681933447, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 49640, "dest_ip": "185.254.126.122", "dest_port": 2525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:20:32.730727+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 49640, "dest_port": 2525}}');
INSERT INTO alerts VALUES(593,1772990456.85668397,'{"timestamp": "2026-03-08T18:20:56.856684+0100", "flow_id": 20256469289408, "event_type": "alert", "src_ip": "45.135.194.48", "src_port": 51565, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T18:20:56.856684+0100", "src_ip": "45.135.194.48", "dest_ip": "185.254.126.122", "src_port": 51565, "dest_port": 5555}}');
INSERT INTO alerts VALUES(594,1772990476.761640072,'{"timestamp": "2026-03-08T18:21:16.761640+0100", "flow_id": 1300897097848641, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 40097, "dest_ip": "185.254.126.122", "dest_port": 7854, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:21:16.761640+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 40097, "dest_port": 7854}}');
INSERT INTO alerts VALUES(595,1772990670.881150007,'{"timestamp": "2026-03-08T18:24:30.881150+0100", "flow_id": 1814188564892950, "event_type": "alert", "src_ip": "34.228.104.231", "src_port": 53747, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T18:24:30.881150+0100", "src_ip": "34.228.104.231", "dest_ip": "185.254.126.122", "src_port": 53747, "dest_port": 1433}}');
INSERT INTO alerts VALUES(596,1772990712.032851935,'{"timestamp": "2026-03-08T18:25:12.032852+0100", "flow_id": 141099229495170, "event_type": "alert", "src_ip": "34.47.37.0", "src_port": 45432, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:25:12.032852+0100", "src_ip": "34.47.37.0", "dest_ip": "185.254.126.122", "src_port": 45432, "dest_port": 3306}}');
INSERT INTO alerts VALUES(597,1772990753.054701089,'{"timestamp": "2026-03-08T18:25:53.054701+0100", "flow_id": 516415018991036, "event_type": "alert", "src_ip": "88.210.63.192", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 333, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:25:53.054701+0100", "src_ip": "88.210.63.192", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 333}}');
INSERT INTO alerts VALUES(598,1772990812.520292998,'{"timestamp": "2026-03-08T18:26:52.520293+0100", "flow_id": 1390217075319517, "event_type": "alert", "src_ip": "185.242.226.97", "src_port": 33568, "dest_ip": "185.254.126.122", "dest_port": 40956, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-08T18:26:52.520293+0100", "src_ip": "185.242.226.97", "dest_ip": "185.254.126.122", "src_port": 33568, "dest_port": 40956}}');
INSERT INTO alerts VALUES(599,1772990826.128971099,'{"timestamp": "2026-03-08T18:27:06.128971+0100", "flow_id": 835401711401709, "event_type": "alert", "src_ip": "64.89.163.241", "src_port": 44342, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:27:06.128971+0100", "src_ip": "64.89.163.241", "dest_ip": "185.254.126.122", "src_port": 44342, "dest_port": 3000}}');
INSERT INTO alerts VALUES(600,1772990866.606152057,'{"timestamp": "2026-03-08T18:27:46.606152+0100", "flow_id": 633079924757403, "event_type": "alert", "src_ip": "45.142.154.87", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 3112, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:27:46.606152+0100", "src_ip": "45.142.154.87", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 3112}}');
INSERT INTO alerts VALUES(601,1772990905.015603065,'{"timestamp": "2026-03-08T18:28:25.015603+0100", "flow_id": 348491736364982, "event_type": "alert", "src_ip": "45.142.154.98", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 110, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:28:25.015603+0100", "src_ip": "45.142.154.98", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 110}}');
INSERT INTO alerts VALUES(602,1772990987.424913884,'{"timestamp": "2026-03-08T18:29:47.424914+0100", "flow_id": 980569264352404, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 14317, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:29:47.424914+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 14317}}');
INSERT INTO alerts VALUES(603,1772990997.676218986,'{"timestamp": "2026-03-08T18:29:57.676219+0100", "flow_id": 1496965450195981, "event_type": "alert", "src_ip": "185.217.188.132", "src_port": 43474, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:29:57.676219+0100", "src_ip": "185.217.188.132", "dest_ip": "185.254.126.122", "src_port": 43474, "dest_port": 1433}}');
INSERT INTO alerts VALUES(604,1772991041.674079896,'{"timestamp": "2026-03-08T18:30:41.674080+0100", "flow_id": 361879129694706, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 48937, "dest_ip": "185.254.126.122", "dest_port": 55475, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:30:41.674080+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 48937, "dest_port": 55475}}');
INSERT INTO alerts VALUES(605,1772991222.345890046,'{"timestamp": "2026-03-08T18:33:42.345890+0100", "flow_id": 1767063836246742, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 48193, "dest_ip": "185.254.126.122", "dest_port": 61809, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:33:42.345890+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 48193, "dest_port": 61809}}');
INSERT INTO alerts VALUES(606,1772991260.052238941,'{"timestamp": "2026-03-08T18:34:20.052239+0100", "flow_id": 1350268476347024, "event_type": "alert", "src_ip": "193.163.125.68", "src_port": 22477, "dest_ip": "185.254.126.122", "dest_port": 3283, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 33, "bytes_toclient": 0, "start": "2026-03-08T18:34:20.052239+0100", "src_ip": "193.163.125.68", "dest_ip": "185.254.126.122", "src_port": 22477, "dest_port": 3283}}');
INSERT INTO alerts VALUES(607,1772991302.818145991,'{"timestamp": "2026-03-08T18:35:02.818146+0100", "flow_id": 1825062651041052, "event_type": "alert", "src_ip": "198.235.24.200", "src_port": 53730, "dest_ip": "185.254.126.122", "dest_port": 21, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:35:02.818146+0100", "src_ip": "198.235.24.200", "dest_ip": "185.254.126.122", "src_port": 53730, "dest_port": 21}}');
INSERT INTO alerts VALUES(608,1772991361.959403038,'{"timestamp": "2026-03-08T18:36:01.959403+0100", "flow_id": 461432146546057, "event_type": "alert", "src_ip": "64.89.163.130", "src_port": 51258, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:36:01.959403+0100", "src_ip": "64.89.163.130", "dest_ip": "185.254.126.122", "src_port": 51258, "dest_port": 27017}}');
INSERT INTO alerts VALUES(609,1772991365.877649069,'{"timestamp": "2026-03-08T18:36:05.877649+0100", "flow_id": 1517675751971992, "event_type": "alert", "src_ip": "178.20.210.136", "src_port": 49261, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:36:05.877649+0100", "src_ip": "178.20.210.136", "dest_ip": "185.254.126.122", "src_port": 49261, "dest_port": 3389}}');
INSERT INTO alerts VALUES(610,1772991413.312537908,'{"timestamp": "2026-03-08T18:36:53.312538+0100", "flow_id": 1623816137484769, "event_type": "alert", "src_ip": "198.235.24.251", "src_port": 55410, "dest_ip": "185.254.126.122", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:36:53.312538+0100", "src_ip": "198.235.24.251", "dest_ip": "185.254.126.122", "src_port": 55410, "dest_port": 5900}}');
INSERT INTO alerts VALUES(611,1772991572.391997099,'{"timestamp": "2026-03-08T18:39:32.391997+0100", "flow_id": 1402140493948477, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3444, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:39:32.391997+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3444}}');
INSERT INTO alerts VALUES(612,1772991605.185529947,'{"timestamp": "2026-03-08T18:40:05.185530+0100", "flow_id": 1641273369683391, "event_type": "alert", "src_ip": "87.121.84.57", "src_port": 38590, "dest_ip": "185.254.126.122", "dest_port": 8082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:40:05.185530+0100", "src_ip": "87.121.84.57", "dest_ip": "185.254.126.122", "src_port": 38590, "dest_port": 8082}}');
INSERT INTO alerts VALUES(613,1772991607.724984884,'{"timestamp": "2026-03-08T18:40:07.724985+0100", "flow_id": 1987888940711922, "event_type": "alert", "src_ip": "46.151.182.188", "src_port": 51377, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:40:07.724985+0100", "src_ip": "46.151.182.188", "dest_ip": "185.254.126.122", "src_port": 51377, "dest_port": 5432}}');
INSERT INTO alerts VALUES(614,1772991607.724984884,'{"timestamp": "2026-03-08T18:40:07.724985+0100", "flow_id": 1987888940711922, "event_type": "alert", "src_ip": "46.151.182.188", "src_port": 51377, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:40:07.724985+0100", "src_ip": "46.151.182.188", "dest_ip": "185.254.126.122", "src_port": 51377, "dest_port": 5432}}');
INSERT INTO alerts VALUES(615,1772991667.577028037,'{"timestamp": "2026-03-08T18:41:07.577028+0100", "flow_id": 1070945433053036, "event_type": "alert", "src_ip": "193.163.125.26", "src_port": 42793, "dest_ip": "185.254.126.122", "dest_port": 502, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:41:07.577028+0100", "src_ip": "193.163.125.26", "dest_ip": "185.254.126.122", "src_port": 42793, "dest_port": 502}}');
INSERT INTO alerts VALUES(616,1772991749.427248002,'{"timestamp": "2026-03-08T18:42:29.427248+0100", "flow_id": 1553542630394285, "event_type": "alert", "src_ip": "176.65.148.96", "src_port": 40700, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T18:42:29.427248+0100", "src_ip": "176.65.148.96", "dest_ip": "185.254.126.122", "src_port": 40700, "dest_port": 8332}}');
INSERT INTO alerts VALUES(617,1772991749.427248002,'{"timestamp": "2026-03-08T18:42:29.427248+0100", "flow_id": 1553542630394285, "event_type": "alert", "src_ip": "176.65.148.96", "src_port": 40700, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T18:42:29.427248+0100", "src_ip": "176.65.148.96", "dest_ip": "185.254.126.122", "src_port": 40700, "dest_port": 8332}}');
INSERT INTO alerts VALUES(618,1772991753.04221201,'{"timestamp": "2026-03-08T18:42:33.042212+0100", "flow_id": 462775993636846, "event_type": "alert", "src_ip": "43.228.157.10", "src_port": 46981, "dest_ip": "185.254.126.122", "dest_port": 12362, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:42:33.042212+0100", "src_ip": "43.228.157.10", "dest_ip": "185.254.126.122", "src_port": 46981, "dest_port": 12362}}');
INSERT INTO alerts VALUES(619,1772991813.737875939,'{"timestamp": "2026-03-08T18:43:33.737876+0100", "flow_id": 1480304181537930, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 62442, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:43:33.737876+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 62442}}');
INSERT INTO alerts VALUES(620,1772991813.737875939,'{"timestamp": "2026-03-08T18:43:33.737876+0100", "flow_id": 1480304181537930, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 62442, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:43:33.737876+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 62442}}');
INSERT INTO alerts VALUES(621,1772991831.683962107,'{"timestamp": "2026-03-08T18:43:51.683962+0100", "flow_id": 2093170899216941, "event_type": "alert", "src_ip": "176.65.134.3", "src_port": 51597, "dest_ip": "185.254.126.122", "dest_port": 4153, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:43:51.683962+0100", "src_ip": "176.65.134.3", "dest_ip": "185.254.126.122", "src_port": 51597, "dest_port": 4153}}');
INSERT INTO alerts VALUES(622,1772991877.563297987,'{"timestamp": "2026-03-08T18:44:37.563298+0100", "flow_id": 1574922774227641, "event_type": "alert", "src_ip": "193.163.125.13", "src_port": 39282, "dest_ip": "185.254.126.122", "dest_port": 1023, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:44:37.563298+0100", "src_ip": "193.163.125.13", "dest_ip": "185.254.126.122", "src_port": 39282, "dest_port": 1023}}');
INSERT INTO alerts VALUES(623,1772991994.662230969,'{"timestamp": "2026-03-08T18:46:34.662231+0100", "flow_id": 592461341962835, "event_type": "alert", "src_ip": "167.94.138.149", "src_port": 9278, "dest_ip": "185.254.126.122", "dest_port": 22922, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T18:46:34.662231+0100", "src_ip": "167.94.138.149", "dest_ip": "185.254.126.122", "src_port": 9278, "dest_port": 22922}}');
INSERT INTO alerts VALUES(624,1772992157.6157341,'{"timestamp": "2026-03-08T18:49:17.615734+0100", "flow_id": 1518658058680205, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 40501, "dest_ip": "185.254.126.122", "dest_port": 2375, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:49:17.615734+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 40501, "dest_port": 2375}}');
INSERT INTO alerts VALUES(625,1772992196.759884119,'{"timestamp": "2026-03-08T18:49:56.759884+0100", "flow_id": 1293352572890251, "event_type": "alert", "src_ip": "87.121.84.50", "src_port": 42885, "dest_ip": "185.254.126.122", "dest_port": 8820, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:49:56.759884+0100", "src_ip": "87.121.84.50", "dest_ip": "185.254.126.122", "src_port": 42885, "dest_port": 8820}}');
INSERT INTO alerts VALUES(626,1772992262.742244006,'{"timestamp": "2026-03-08T18:51:02.742244+0100", "flow_id": 1780542358765425, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 48935, "dest_ip": "185.254.126.122", "dest_port": 62815, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:51:02.742244+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 48935, "dest_port": 62815}}');
INSERT INTO alerts VALUES(627,1772992440.205645084,'{"timestamp": "2026-03-08T18:54:00.205645+0100", "flow_id": 38816982420982, "event_type": "alert", "src_ip": "64.89.163.79", "src_port": 52391, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:54:00.205645+0100", "src_ip": "64.89.163.79", "dest_ip": "185.254.126.122", "src_port": 52391, "dest_port": 3306}}');
INSERT INTO alerts VALUES(628,1772992440.205645084,'{"timestamp": "2026-03-08T18:54:00.205645+0100", "flow_id": 38816982420982, "event_type": "alert", "src_ip": "64.89.163.79", "src_port": 52391, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:54:00.205645+0100", "src_ip": "64.89.163.79", "dest_ip": "185.254.126.122", "src_port": 52391, "dest_port": 3306}}');
INSERT INTO alerts VALUES(629,1772992477.990905047,'{"timestamp": "2026-03-08T18:54:37.990905+0100", "flow_id": 1441158333787227, "event_type": "alert", "src_ip": "79.124.62.178", "src_port": 56406, "dest_ip": "185.254.126.122", "dest_port": 53389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:54:37.990905+0100", "src_ip": "79.124.62.178", "dest_ip": "185.254.126.122", "src_port": 56406, "dest_port": 53389}}');
INSERT INTO alerts VALUES(630,1772992557.609440088,'{"timestamp": "2026-03-08T18:55:57.609440+0100", "flow_id": 1491626047292700, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 22762, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:55:57.609440+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 22762}}');
INSERT INTO alerts VALUES(631,1772992557.609440088,'{"timestamp": "2026-03-08T18:55:57.609440+0100", "flow_id": 1491626047292700, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 22762, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:55:57.609440+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 22762}}');
INSERT INTO alerts VALUES(632,1772992574.254558087,'{"timestamp": "2026-03-08T18:56:14.254558+0100", "flow_id": 1937745374812845, "event_type": "alert", "src_ip": "167.94.138.156", "src_port": 53577, "dest_ip": "185.254.126.122", "dest_port": 18789, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T18:56:14.254558+0100", "src_ip": "167.94.138.156", "dest_ip": "185.254.126.122", "src_port": 53577, "dest_port": 18789}}');
INSERT INTO alerts VALUES(633,1772992655.528456927,'{"timestamp": "2026-03-08T18:57:35.528457+0100", "flow_id": 1988233414251818, "event_type": "alert", "src_ip": "176.65.148.197", "src_port": 45968, "dest_ip": "185.254.126.122", "dest_port": 5005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:57:35.528457+0100", "src_ip": "176.65.148.197", "dest_ip": "185.254.126.122", "src_port": 45968, "dest_port": 5005}}');
INSERT INTO alerts VALUES(634,1772992655.528456927,'{"timestamp": "2026-03-08T18:57:35.528457+0100", "flow_id": 1988233414251818, "event_type": "alert", "src_ip": "176.65.148.197", "src_port": 45968, "dest_ip": "185.254.126.122", "dest_port": 5005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:57:35.528457+0100", "src_ip": "176.65.148.197", "dest_ip": "185.254.126.122", "src_port": 45968, "dest_port": 5005}}');
INSERT INTO alerts VALUES(635,1772992656.080064058,'{"timestamp": "2026-03-08T18:57:36.080064+0100", "flow_id": 62400079135592, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 46876, "dest_ip": "185.254.126.122", "dest_port": 31522, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T18:57:36.080064+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 46876, "dest_port": 31522}}');
INSERT INTO alerts VALUES(636,1772992674.612891912,'{"timestamp": "2026-03-08T18:57:54.612892+0100", "flow_id": 662027457684331, "event_type": "alert", "src_ip": "185.156.73.182", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44431, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:57:54.612892+0100", "src_ip": "185.156.73.182", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44431}}');
INSERT INTO alerts VALUES(637,1772992715.219897032,'{"timestamp": "2026-03-08T18:58:35.219897+0100", "flow_id": 944451638835348, "event_type": "alert", "src_ip": "162.217.98.180", "src_port": 40014, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 414, "bytes_toclient": 0, "start": "2026-03-08T18:58:35.219897+0100", "src_ip": "162.217.98.180", "dest_ip": "185.254.126.122", "src_port": 40014, "dest_port": 5060}}');
INSERT INTO alerts VALUES(638,1772992732.199340105,'{"timestamp": "2026-03-08T18:58:52.199340+0100", "flow_id": 1137635715162371, "event_type": "alert", "src_ip": "178.20.210.151", "src_port": 50083, "dest_ip": "185.254.126.122", "dest_port": 2181, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T18:58:52.199340+0100", "src_ip": "178.20.210.151", "dest_ip": "185.254.126.122", "src_port": 50083, "dest_port": 2181}}');
INSERT INTO alerts VALUES(639,1772992779.51056099,'{"timestamp": "2026-03-08T18:59:39.510561+0100", "flow_id": 1066946325194420, "event_type": "alert", "src_ip": "176.65.139.45", "src_port": 37643, "dest_ip": "185.254.126.122", "dest_port": 17001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T18:59:39.510561+0100", "src_ip": "176.65.139.45", "dest_ip": "185.254.126.122", "src_port": 37643, "dest_port": 17001}}');
INSERT INTO alerts VALUES(640,1772992815.817234992,'{"timestamp": "2026-03-08T19:00:15.817235+0100", "flow_id": 2102624494857220, "event_type": "alert", "src_ip": "66.132.153.155", "src_port": 10071, "dest_ip": "185.254.126.122", "dest_port": 20000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:00:15.817235+0100", "src_ip": "66.132.153.155", "dest_ip": "185.254.126.122", "src_port": 10071, "dest_port": 20000}}');
INSERT INTO alerts VALUES(641,1772992840.495302915,'{"timestamp": "2026-03-08T19:00:40.495303+0100", "flow_id": 156988831241324, "event_type": "alert", "src_ip": "192.109.200.157", "src_port": 58001, "dest_ip": "185.254.126.122", "dest_port": 34567, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:00:40.495303+0100", "src_ip": "192.109.200.157", "dest_ip": "185.254.126.122", "src_port": 58001, "dest_port": 34567}}');
INSERT INTO alerts VALUES(642,1772992841.303529024,'{"timestamp": "2026-03-08T19:00:41.303529+0100", "flow_id": 459225113155168, "event_type": "alert", "src_ip": "45.142.154.99", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 20202, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:00:41.303529+0100", "src_ip": "45.142.154.99", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 20202}}');
INSERT INTO alerts VALUES(643,1772992854.93322897,'{"timestamp": "2026-03-08T19:00:54.933229+0100", "flow_id": 1756389143121918, "event_type": "alert", "src_ip": "176.65.148.243", "src_port": 47397, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:00:54.933229+0100", "src_ip": "176.65.148.243", "dest_ip": "185.254.126.122", "src_port": 47397, "dest_port": 25565}}');
INSERT INTO alerts VALUES(644,1772992854.93322897,'{"timestamp": "2026-03-08T19:00:54.933229+0100", "flow_id": 1756389143121918, "event_type": "alert", "src_ip": "176.65.148.243", "src_port": 47397, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:00:54.933229+0100", "src_ip": "176.65.148.243", "dest_ip": "185.254.126.122", "src_port": 47397, "dest_port": 25565}}');
INSERT INTO alerts VALUES(645,1772992984.180638074,'{"timestamp": "2026-03-08T19:03:04.180638+0100", "flow_id": 212885881650058, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 51176, "dest_ip": "185.254.126.122", "dest_port": 18765, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:03:04.180638+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 51176, "dest_port": 18765}}');
INSERT INTO alerts VALUES(646,1772992984.180638074,'{"timestamp": "2026-03-08T19:03:04.180638+0100", "flow_id": 212885881650058, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 51176, "dest_ip": "185.254.126.122", "dest_port": 18765, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:03:04.180638+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 51176, "dest_port": 18765}}');
INSERT INTO alerts VALUES(647,1772993001.959125041,'{"timestamp": "2026-03-08T19:03:21.959125+0100", "flow_id": 464528879654812, "event_type": "alert", "src_ip": "34.77.87.222", "src_port": 45737, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2001219, "rev": 20, "signature": "ET SCAN Potential SSH Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 88, "bytes_toclient": 0, "start": "2026-03-08T19:03:21.108156+0100", "src_ip": "34.77.87.222", "dest_ip": "185.254.126.122", "src_port": 45737, "dest_port": 22}}');
INSERT INTO alerts VALUES(648,1772993010.253139972,'{"timestamp": "2026-03-08T19:03:30.253140+0100", "flow_id": 805753532462123, "event_type": "alert", "src_ip": "167.94.138.97", "src_port": 31927, "dest_ip": "185.254.126.122", "dest_port": 64235, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:03:30.253140+0100", "src_ip": "167.94.138.97", "dest_ip": "185.254.126.122", "src_port": 31927, "dest_port": 64235}}');
INSERT INTO alerts VALUES(649,1772993015.734673023,'{"timestamp": "2026-03-08T19:03:35.734673+0100", "flow_id": 2029499643965952, "event_type": "alert", "src_ip": "187.107.8.55", "src_port": 48338, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:03:35.734673+0100", "src_ip": "187.107.8.55", "dest_ip": "185.254.126.122", "src_port": 48338, "dest_port": 1433}}');
INSERT INTO alerts VALUES(650,1772993033.478796006,'{"timestamp": "2026-03-08T19:03:53.478796+0100", "flow_id": 367564616512110, "event_type": "alert", "src_ip": "176.65.149.180", "src_port": 54863, "dest_ip": "185.254.126.122", "dest_port": 8265, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:03:53.478796+0100", "src_ip": "176.65.149.180", "dest_ip": "185.254.126.122", "src_port": 54863, "dest_port": 8265}}');
INSERT INTO alerts VALUES(651,1772993037.017303944,'{"timestamp": "2026-03-08T19:03:57.017304+0100", "flow_id": 1481698694925740, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 58397, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:03:57.017304+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 58397, "dest_port": 443}}');
INSERT INTO alerts VALUES(652,1772993071.012602091,'{"timestamp": "2026-03-08T19:04:31.012602+0100", "flow_id": 2024451157657611, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 52541, "dest_ip": "185.254.126.122", "dest_port": 3310, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:04:31.012602+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 52541, "dest_port": 3310}}');
INSERT INTO alerts VALUES(653,1772993071.012602091,'{"timestamp": "2026-03-08T19:04:31.012602+0100", "flow_id": 2024451157657611, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 52541, "dest_ip": "185.254.126.122", "dest_port": 3310, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:04:31.012602+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 52541, "dest_port": 3310}}');
INSERT INTO alerts VALUES(654,1772993177.567368984,'{"timestamp": "2026-03-08T19:06:17.567369+0100", "flow_id": 466508560984802, "event_type": "alert", "src_ip": "167.94.138.129", "src_port": 35423, "dest_ip": "185.254.126.122", "dest_port": 7443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:06:17.567369+0100", "src_ip": "167.94.138.129", "dest_ip": "185.254.126.122", "src_port": 35423, "dest_port": 7443}}');
INSERT INTO alerts VALUES(655,1772993192.259644031,'{"timestamp": "2026-03-08T19:06:32.259644+0100", "flow_id": 270740375727484, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:06:32.259644+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44332}}');
INSERT INTO alerts VALUES(656,1772993251.555756092,'{"timestamp": "2026-03-08T19:07:31.555756+0100", "flow_id": 979579725536547, "event_type": "alert", "src_ip": "185.242.226.103", "src_port": 58331, "dest_ip": "185.254.126.122", "dest_port": 5950, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:07:31.555756+0100", "src_ip": "185.242.226.103", "dest_ip": "185.254.126.122", "src_port": 58331, "dest_port": 5950}}');
INSERT INTO alerts VALUES(657,1772993251.802834987,'{"timestamp": "2026-03-08T19:07:31.802835+0100", "flow_id": 914878777351784, "event_type": "alert", "src_ip": "167.94.138.142", "src_port": 6349, "dest_ip": "185.254.126.122", "dest_port": 8880, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:07:31.802835+0100", "src_ip": "167.94.138.142", "dest_ip": "185.254.126.122", "src_port": 6349, "dest_port": 8880}}');
INSERT INTO alerts VALUES(658,1772993390.157857894,'{"timestamp": "2026-03-08T19:09:50.157858+0100", "flow_id": 1803896445987800, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 50160, "dest_ip": "185.254.126.122", "dest_port": 115, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:09:50.157858+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 50160, "dest_port": 115}}');
INSERT INTO alerts VALUES(659,1772993484.473695039,'{"timestamp": "2026-03-08T19:11:24.473695+0100", "flow_id": 1190079917508902, "event_type": "alert", "src_ip": "198.235.24.253", "src_port": 50964, "dest_ip": "185.254.126.122", "dest_port": 3443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:11:24.473695+0100", "src_ip": "198.235.24.253", "dest_ip": "185.254.126.122", "src_port": 50964, "dest_port": 3443}}');
INSERT INTO alerts VALUES(660,1772993511.263313056,'{"timestamp": "2026-03-08T19:11:51.263313+0100", "flow_id": 1975349259186691, "event_type": "alert", "src_ip": "176.65.149.233", "src_port": 39584, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:11:51.263313+0100", "src_ip": "176.65.149.233", "dest_ip": "185.254.126.122", "src_port": 39584, "dest_port": 8088}}');
INSERT INTO alerts VALUES(661,1772993572.937309026,'{"timestamp": "2026-03-08T19:12:52.937309+0100", "flow_id": 1210962594636731, "event_type": "alert", "src_ip": "193.163.125.28", "src_port": 33040, "dest_ip": "185.254.126.122", "dest_port": 8222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:12:52.937309+0100", "src_ip": "193.163.125.28", "dest_ip": "185.254.126.122", "src_port": 33040, "dest_port": 8222}}');
INSERT INTO alerts VALUES(662,1772993573.770606995,'{"timestamp": "2026-03-08T19:12:53.770607+0100", "flow_id": 1620882596890942, "event_type": "alert", "src_ip": "205.210.31.235", "src_port": 56897, "dest_ip": "185.254.126.122", "dest_port": 4911, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:12:53.770607+0100", "src_ip": "205.210.31.235", "dest_ip": "185.254.126.122", "src_port": 56897, "dest_port": 4911}}');
INSERT INTO alerts VALUES(663,1772993590.459197044,'{"timestamp": "2026-03-08T19:13:10.459197+0100", "flow_id": 1690765299878868, "event_type": "alert", "src_ip": "205.210.31.67", "src_port": 53501, "dest_ip": "185.254.126.122", "dest_port": 9092, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:13:10.459197+0100", "src_ip": "205.210.31.67", "dest_ip": "185.254.126.122", "src_port": 53501, "dest_port": 9092}}');
INSERT INTO alerts VALUES(664,1772993590.520320892,'{"timestamp": "2026-03-08T19:13:10.520321+0100", "flow_id": 1953289825650821, "event_type": "alert", "src_ip": "205.210.31.75", "src_port": 51030, "dest_ip": "185.254.126.122", "dest_port": 54498, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:13:10.520321+0100", "src_ip": "205.210.31.75", "dest_ip": "185.254.126.122", "src_port": 51030, "dest_port": 54498}}');
INSERT INTO alerts VALUES(665,1772993739.925648927,'{"timestamp": "2026-03-08T19:15:39.925649+0100", "flow_id": 879410663066380, "event_type": "alert", "src_ip": "205.210.31.41", "src_port": 52216, "dest_ip": "185.254.126.122", "dest_port": 4100, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:15:39.925649+0100", "src_ip": "205.210.31.41", "dest_ip": "185.254.126.122", "src_port": 52216, "dest_port": 4100}}');
INSERT INTO alerts VALUES(666,1772993743.962327004,'{"timestamp": "2026-03-08T19:15:43.962327+0100", "flow_id": 2162841810119228, "event_type": "alert", "src_ip": "205.210.31.240", "src_port": 55128, "dest_ip": "185.254.126.122", "dest_port": 88, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:15:43.962327+0100", "src_ip": "205.210.31.240", "dest_ip": "185.254.126.122", "src_port": 55128, "dest_port": 88}}');
INSERT INTO alerts VALUES(667,1772993893.291223049,'{"timestamp": "2026-03-08T19:18:13.291223+0100", "flow_id": 1532269859725608, "event_type": "alert", "src_ip": "167.94.146.33", "src_port": 36069, "dest_ip": "185.254.126.122", "dest_port": 29201, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:18:13.291223+0100", "src_ip": "167.94.146.33", "dest_ip": "185.254.126.122", "src_port": 36069, "dest_port": 29201}}');
INSERT INTO alerts VALUES(668,1772994087.752329112,'{"timestamp": "2026-03-08T19:21:27.752329+0100", "flow_id": 2105329769513192, "event_type": "alert", "src_ip": "205.210.31.56", "src_port": 56503, "dest_ip": "185.254.126.122", "dest_port": 2160, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:21:27.752329+0100", "src_ip": "205.210.31.56", "dest_ip": "185.254.126.122", "src_port": 56503, "dest_port": 2160}}');
INSERT INTO alerts VALUES(669,1772994105.818120957,'{"timestamp": "2026-03-08T19:21:45.818121+0100", "flow_id": 417579899736440, "event_type": "alert", "src_ip": "193.163.125.6", "src_port": 58816, "dest_ip": "185.254.126.122", "dest_port": 50000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:21:45.818121+0100", "src_ip": "193.163.125.6", "dest_ip": "185.254.126.122", "src_port": 58816, "dest_port": 50000}}');
INSERT INTO alerts VALUES(670,1772994275.646025897,'{"timestamp": "2026-03-08T19:24:35.646026+0100", "flow_id": 1085814593366943, "event_type": "alert", "src_ip": "147.185.132.106", "src_port": 53576, "dest_ip": "185.254.126.122", "dest_port": 8008, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:24:35.646026+0100", "src_ip": "147.185.132.106", "dest_ip": "185.254.126.122", "src_port": 53576, "dest_port": 8008}}');
INSERT INTO alerts VALUES(671,1772994360.368696928,'{"timestamp": "2026-03-08T19:26:00.368697+0100", "flow_id": 176170378285767, "event_type": "alert", "src_ip": "91.196.152.148", "src_port": 47369, "dest_ip": "185.254.126.122", "dest_port": 52951, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:26:00.368697+0100", "src_ip": "91.196.152.148", "dest_ip": "185.254.126.122", "src_port": 47369, "dest_port": 52951}}');
INSERT INTO alerts VALUES(672,1772994471.634162903,'{"timestamp": "2026-03-08T19:27:51.634163+0100", "flow_id": 2160762888928919, "event_type": "alert", "src_ip": "64.89.163.144", "src_port": 54388, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:27:51.634163+0100", "src_ip": "64.89.163.144", "dest_ip": "185.254.126.122", "src_port": 54388, "dest_port": 3306}}');
INSERT INTO alerts VALUES(673,1772994471.634162903,'{"timestamp": "2026-03-08T19:27:51.634163+0100", "flow_id": 2160762888928919, "event_type": "alert", "src_ip": "64.89.163.144", "src_port": 54388, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:27:51.634163+0100", "src_ip": "64.89.163.144", "dest_ip": "185.254.126.122", "src_port": 54388, "dest_port": 3306}}');
INSERT INTO alerts VALUES(674,1772994771.354285956,'{"timestamp": "2026-03-08T19:32:51.354286+0100", "flow_id": 958698993561799, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44377, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:32:51.354286+0100", "src_ip": "185.156.73.86", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44377}}');
INSERT INTO alerts VALUES(675,1772994774.528369904,'{"timestamp": "2026-03-08T19:32:54.528370+0100", "flow_id": 1706384384619251, "event_type": "alert", "src_ip": "193.163.125.29", "src_port": 40536, "dest_ip": "185.254.126.122", "dest_port": 61616, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:32:54.528370+0100", "src_ip": "193.163.125.29", "dest_ip": "185.254.126.122", "src_port": 40536, "dest_port": 61616}}');
INSERT INTO alerts VALUES(676,1772994799.353790044,'{"timestamp": "2026-03-08T19:33:19.353790+0100", "flow_id": 2082469998397305, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 40097, "dest_ip": "185.254.126.122", "dest_port": 38080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:33:19.353790+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 40097, "dest_port": 38080}}');
INSERT INTO alerts VALUES(677,1772994810.820534945,'{"timestamp": "2026-03-08T19:33:30.820535+0100", "flow_id": 709425288779080, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 11906, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:33:30.820535+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 11906}}');
INSERT INTO alerts VALUES(678,1772994814.746771098,'{"timestamp": "2026-03-08T19:33:34.746771+0100", "flow_id": 1799982736885010, "event_type": "alert", "src_ip": "205.210.31.70", "src_port": 53201, "dest_ip": "185.254.126.122", "dest_port": 636, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:33:34.746771+0100", "src_ip": "205.210.31.70", "dest_ip": "185.254.126.122", "src_port": 53201, "dest_port": 636}}');
INSERT INTO alerts VALUES(679,1772994866.57742405,'{"timestamp": "2026-03-08T19:34:26.577424+0100", "flow_id": 791168492019746, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 58271, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T19:34:26.577424+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 58271, "dest_port": 8545}}');
INSERT INTO alerts VALUES(680,1772994866.57742405,'{"timestamp": "2026-03-08T19:34:26.577424+0100", "flow_id": 791168492019746, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 58271, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T19:34:26.577424+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 58271, "dest_port": 8545}}');
INSERT INTO alerts VALUES(681,1772994917.196999074,'{"timestamp": "2026-03-08T19:35:17.196999+0100", "flow_id": 1409055543183191, "event_type": "alert", "src_ip": "205.210.31.206", "src_port": 54350, "dest_ip": "185.254.126.122", "dest_port": 401, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:35:17.196999+0100", "src_ip": "205.210.31.206", "dest_ip": "185.254.126.122", "src_port": 54350, "dest_port": 401}}');
INSERT INTO alerts VALUES(682,1772994920.685939074,'{"timestamp": "2026-03-08T19:35:20.685939+0100", "flow_id": 131338207120446, "event_type": "alert", "src_ip": "167.94.146.78", "src_port": 41271, "dest_ip": "185.254.126.122", "dest_port": 28001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:35:20.685939+0100", "src_ip": "167.94.146.78", "dest_ip": "185.254.126.122", "src_port": 41271, "dest_port": 28001}}');
INSERT INTO alerts VALUES(683,1772994971.196753026,'{"timestamp": "2026-03-08T19:36:11.196753+0100", "flow_id": 845050356380072, "event_type": "alert", "src_ip": "167.94.138.131", "src_port": 31840, "dest_ip": "185.254.126.122", "dest_port": 5000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:36:11.196753+0100", "src_ip": "167.94.138.131", "dest_ip": "185.254.126.122", "src_port": 31840, "dest_port": 5000}}');
INSERT INTO alerts VALUES(684,1772994988.587193013,'{"timestamp": "2026-03-08T19:36:28.587193+0100", "flow_id": 1396078648969088, "event_type": "alert", "src_ip": "198.235.24.99", "src_port": 31163, "dest_ip": "185.254.126.122", "dest_port": 13546, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-08T19:36:28.587193+0100", "src_ip": "198.235.24.99", "dest_ip": "185.254.126.122", "src_port": 31163, "dest_port": 13546}}');
INSERT INTO alerts VALUES(685,1772994989.423645973,'{"timestamp": "2026-03-08T19:36:29.423646+0100", "flow_id": 1538070937673635, "event_type": "alert", "src_ip": "66.132.153.145", "src_port": 64502, "dest_ip": "185.254.126.122", "dest_port": 9601, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:36:29.423646+0100", "src_ip": "66.132.153.145", "dest_ip": "185.254.126.122", "src_port": 64502, "dest_port": 9601}}');
INSERT INTO alerts VALUES(686,1772995008.244560956,'{"timestamp": "2026-03-08T19:36:48.244561+0100", "flow_id": 205959809842690, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 45671, "dest_ip": "185.254.126.122", "dest_port": 4742, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T19:36:48.244561+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 45671, "dest_port": 4742}}');
INSERT INTO alerts VALUES(687,1772995008.244560956,'{"timestamp": "2026-03-08T19:36:48.244561+0100", "flow_id": 205959809842690, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 45671, "dest_ip": "185.254.126.122", "dest_port": 4742, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T19:36:48.244561+0100", "src_ip": "192.109.200.219", "dest_ip": "185.254.126.122", "src_port": 45671, "dest_port": 4742}}');
INSERT INTO alerts VALUES(688,1772995008.335062026,'{"timestamp": "2026-03-08T19:36:48.335062+0100", "flow_id": 31708159319973, "event_type": "alert", "src_ip": "167.94.138.135", "src_port": 28363, "dest_ip": "185.254.126.122", "dest_port": 523, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 48, "bytes_toclient": 0, "start": "2026-03-08T19:36:48.335062+0100", "src_ip": "167.94.138.135", "dest_ip": "185.254.126.122", "src_port": 28363, "dest_port": 523}}');
INSERT INTO alerts VALUES(689,1772995095.39770794,'{"timestamp": "2026-03-08T19:38:15.397708+0100", "flow_id": 1989618200127346, "event_type": "alert", "src_ip": "193.163.125.19", "src_port": 50639, "dest_ip": "185.254.126.122", "dest_port": 1984, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:38:15.397708+0100", "src_ip": "193.163.125.19", "dest_ip": "185.254.126.122", "src_port": 50639, "dest_port": 1984}}');
INSERT INTO alerts VALUES(690,1772995123.563826085,'{"timestamp": "2026-03-08T19:38:43.563826+0100", "flow_id": 1014241138300592, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 49640, "dest_ip": "185.254.126.122", "dest_port": 465, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:38:43.563826+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 49640, "dest_port": 465}}');
INSERT INTO alerts VALUES(691,1772995203.852582931,'{"timestamp": "2026-03-08T19:40:03.852583+0100", "flow_id": 847068769045083, "event_type": "alert", "src_ip": "193.163.125.24", "src_port": 35337, "dest_ip": "185.254.126.122", "dest_port": 2187, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:40:03.852583+0100", "src_ip": "193.163.125.24", "dest_ip": "185.254.126.122", "src_port": 35337, "dest_port": 2187}}');
INSERT INTO alerts VALUES(692,1772995262.935532093,'{"timestamp": "2026-03-08T19:41:02.935532+0100", "flow_id": 1766282329281385, "event_type": "alert", "src_ip": "167.94.138.150", "src_port": 7616, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:41:02.935532+0100", "src_ip": "167.94.138.150", "dest_ip": "185.254.126.122", "src_port": 7616, "dest_port": 22}}');
INSERT INTO alerts VALUES(693,1772995266.97458601,'{"timestamp": "2026-03-08T19:41:06.974586+0100", "flow_id": 808117782829884, "event_type": "alert", "src_ip": "43.228.157.17", "src_port": 53005, "dest_ip": "185.254.126.122", "dest_port": 37122, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:41:06.974586+0100", "src_ip": "43.228.157.17", "dest_ip": "185.254.126.122", "src_port": 53005, "dest_port": 37122}}');
INSERT INTO alerts VALUES(694,1772995323.010782958,'{"timestamp": "2026-03-08T19:42:03.010783+0100", "flow_id": 890739487436191, "event_type": "alert", "src_ip": "167.94.138.155", "src_port": 20059, "dest_ip": "185.254.126.122", "dest_port": 11103, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:42:03.010783+0100", "src_ip": "167.94.138.155", "dest_ip": "185.254.126.122", "src_port": 20059, "dest_port": 11103}}');
INSERT INTO alerts VALUES(695,1772995325.548019887,'{"timestamp": "2026-03-08T19:42:05.548020+0100", "flow_id": 1509303387123140, "event_type": "alert", "src_ip": "147.185.132.207", "src_port": 55026, "dest_ip": "185.254.126.122", "dest_port": 4332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:42:05.548020+0100", "src_ip": "147.185.132.207", "dest_ip": "185.254.126.122", "src_port": 55026, "dest_port": 4332}}');
INSERT INTO alerts VALUES(696,1772995338.09719801,'{"timestamp": "2026-03-08T19:42:18.097198+0100", "flow_id": 698938872869123, "event_type": "alert", "src_ip": "167.94.138.153", "src_port": 50251, "dest_ip": "185.254.126.122", "dest_port": 1913, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:42:18.097198+0100", "src_ip": "167.94.138.153", "dest_ip": "185.254.126.122", "src_port": 50251, "dest_port": 1913}}');
INSERT INTO alerts VALUES(697,1772995406.697103977,'{"timestamp": "2026-03-08T19:43:26.697104+0100", "flow_id": 1868143199777937, "event_type": "alert", "src_ip": "130.12.180.52", "src_port": 59044, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:43:26.697104+0100", "src_ip": "130.12.180.52", "dest_ip": "185.254.126.122", "src_port": 59044, "dest_port": 80}}');
INSERT INTO alerts VALUES(698,1772995406.697103977,'{"timestamp": "2026-03-08T19:43:26.697104+0100", "flow_id": 1868143199777937, "event_type": "alert", "src_ip": "130.12.180.52", "src_port": 59044, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:43:26.697104+0100", "src_ip": "130.12.180.52", "dest_ip": "185.254.126.122", "src_port": 59044, "dest_port": 80}}');
INSERT INTO alerts VALUES(699,1772995475.093594075,'{"timestamp": "2026-03-08T19:44:35.093594+0100", "flow_id": 964935316864358, "event_type": "alert", "src_ip": "167.94.146.39", "src_port": 40071, "dest_ip": "185.254.126.122", "dest_port": 54971, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:44:35.093594+0100", "src_ip": "167.94.146.39", "dest_ip": "185.254.126.122", "src_port": 40071, "dest_port": 54971}}');
INSERT INTO alerts VALUES(700,1772995499.184041977,'{"timestamp": "2026-03-08T19:44:59.184042+0100", "flow_id": 1071932738382960, "event_type": "alert", "src_ip": "198.235.24.111", "src_port": 54050, "dest_ip": "185.254.126.122", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:44:59.184042+0100", "src_ip": "198.235.24.111", "dest_ip": "185.254.126.122", "src_port": 54050, "dest_port": 8088}}');
INSERT INTO alerts VALUES(701,1772995537.403551101,'{"timestamp": "2026-03-08T19:45:37.403551+0100", "flow_id": 325864129933598, "event_type": "alert", "src_ip": "45.153.34.32", "src_port": 45717, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:45:37.403551+0100", "src_ip": "45.153.34.32", "dest_ip": "185.254.126.122", "src_port": 45717, "dest_port": 3306}}');
INSERT INTO alerts VALUES(702,1772995537.403551101,'{"timestamp": "2026-03-08T19:45:37.403551+0100", "flow_id": 325864129933598, "event_type": "alert", "src_ip": "45.153.34.32", "src_port": 45717, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:45:37.403551+0100", "src_ip": "45.153.34.32", "dest_ip": "185.254.126.122", "src_port": 45717, "dest_port": 3306}}');
INSERT INTO alerts VALUES(703,1772995581.1728549,'{"timestamp": "2026-03-08T19:46:21.172855+0100", "flow_id": 1586834760204609, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 53303, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:46:21.172855+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 53303, "dest_port": 3389}}');
INSERT INTO alerts VALUES(704,1772995599.176259041,'{"timestamp": "2026-03-08T19:46:39.176259+0100", "flow_id": 2164404857944116, "event_type": "alert", "src_ip": "198.235.24.117", "src_port": 52197, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 88, "bytes_toclient": 0, "start": "2026-03-08T19:46:39.176259+0100", "src_ip": "198.235.24.117", "dest_ip": "185.254.126.122", "src_port": 52197, "dest_port": 161}}');
INSERT INTO alerts VALUES(705,1772995635.836234092,'{"timestamp": "2026-03-08T19:47:15.836234+0100", "flow_id": 1058326076584971, "event_type": "alert", "src_ip": "147.185.132.15", "src_port": 51576, "dest_ip": "185.254.126.122", "dest_port": 444, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:47:15.836234+0100", "src_ip": "147.185.132.15", "dest_ip": "185.254.126.122", "src_port": 51576, "dest_port": 444}}');
INSERT INTO alerts VALUES(706,1772995684.746699094,'{"timestamp": "2026-03-08T19:48:04.746699+0100", "flow_id": 1236724216616074, "event_type": "alert", "src_ip": "205.210.31.88", "src_port": 50545, "dest_ip": "185.254.126.122", "dest_port": 3388, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:48:04.746699+0100", "src_ip": "205.210.31.88", "dest_ip": "185.254.126.122", "src_port": 50545, "dest_port": 3388}}');
INSERT INTO alerts VALUES(707,1772995697.940557004,'{"timestamp": "2026-03-08T19:48:17.940557+0100", "flow_id": 380487529683113, "event_type": "alert", "src_ip": "205.210.31.82", "src_port": 49586, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:48:17.940557+0100", "src_ip": "205.210.31.82", "dest_ip": "185.254.126.122", "src_port": 49586, "dest_port": 389}}');
INSERT INTO alerts VALUES(708,1772995721.124123097,'{"timestamp": "2026-03-08T19:48:41.124123+0100", "flow_id": 533107533531209, "event_type": "alert", "src_ip": "165.154.33.72", "src_port": 36028, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:48:41.124123+0100", "src_ip": "165.154.33.72", "dest_ip": "185.254.126.122", "src_port": 36028, "dest_port": 3306}}');
INSERT INTO alerts VALUES(709,1772995788.537116051,'{"timestamp": "2026-03-08T19:49:48.537116+0100", "flow_id": 1180998313044787, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2083, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:49:48.537116+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2083}}');
INSERT INTO alerts VALUES(710,1772995788.537116051,'{"timestamp": "2026-03-08T19:49:48.537116+0100", "flow_id": 1180998313044787, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2083, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:49:48.537116+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2083}}');
INSERT INTO alerts VALUES(711,1772995807.507404088,'{"timestamp": "2026-03-08T19:50:07.507404+0100", "flow_id": 2179285035006735, "event_type": "alert", "src_ip": "167.94.138.152", "src_port": 29178, "dest_ip": "185.254.126.122", "dest_port": 2095, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:50:07.507404+0100", "src_ip": "167.94.138.152", "dest_ip": "185.254.126.122", "src_port": 29178, "dest_port": 2095}}');
INSERT INTO alerts VALUES(712,1772995813.538088084,'{"timestamp": "2026-03-08T19:50:13.538088+0100", "flow_id": 1466648772944491, "event_type": "alert", "src_ip": "193.163.125.12", "src_port": 49262, "dest_ip": "185.254.126.122", "dest_port": 21, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:50:13.538088+0100", "src_ip": "193.163.125.12", "dest_ip": "185.254.126.122", "src_port": 49262, "dest_port": 21}}');
INSERT INTO alerts VALUES(713,1772995874.909337044,'{"timestamp": "2026-03-08T19:51:14.909337+0100", "flow_id": 809351825471204, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55728, "dest_ip": "185.254.126.122", "dest_port": 10337, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:51:14.909337+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 55728, "dest_port": 10337}}');
INSERT INTO alerts VALUES(714,1772995901.068651915,'{"timestamp": "2026-03-08T19:51:41.068652+0100", "flow_id": 1420760451936820, "event_type": "alert", "src_ip": "193.163.125.36", "src_port": 50679, "dest_ip": "185.254.126.122", "dest_port": 2525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:51:41.068652+0100", "src_ip": "193.163.125.36", "dest_ip": "185.254.126.122", "src_port": 50679, "dest_port": 2525}}');
INSERT INTO alerts VALUES(715,1772995949.170414924,'{"timestamp": "2026-03-08T19:52:29.170415+0100", "flow_id": 1576351805473261, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 34073, "dest_ip": "185.254.126.122", "dest_port": 2376, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:52:29.170415+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 34073, "dest_port": 2376}}');
INSERT INTO alerts VALUES(716,1772995952.872150897,'{"timestamp": "2026-03-08T19:52:32.872151+0100", "flow_id": 86686373456639, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 20287, "dest_ip": "185.254.126.122", "dest_port": 50941, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:52:32.872151+0100", "src_ip": "167.94.146.46", "dest_ip": "185.254.126.122", "src_port": 20287, "dest_port": 50941}}');
INSERT INTO alerts VALUES(717,1772995961.980679035,'{"timestamp": "2026-03-08T19:52:41.980679+0100", "flow_id": 552810111475742, "event_type": "alert", "src_ip": "176.65.134.24", "src_port": 64391, "dest_ip": "185.254.126.122", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 48, "bytes_toclient": 0, "start": "2026-03-08T19:52:41.980679+0100", "src_ip": "176.65.134.24", "dest_ip": "185.254.126.122", "src_port": 64391, "dest_port": 25565}}');
INSERT INTO alerts VALUES(718,1772995962.753876925,'{"timestamp": "2026-03-08T19:52:42.753877+0100", "flow_id": 704602445785734, "event_type": "alert", "src_ip": "172.104.100.117", "src_port": 44894, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T19:52:42.753877+0100", "src_ip": "172.104.100.117", "dest_ip": "185.254.126.122", "src_port": 44894, "dest_port": 5432}}');
INSERT INTO alerts VALUES(719,1772995968.909221888,'{"timestamp": "2026-03-08T19:52:48.909222+0100", "flow_id": 245905361228359, "event_type": "alert", "src_ip": "87.121.84.76", "src_port": 40446, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:52:48.909222+0100", "src_ip": "87.121.84.76", "dest_ip": "185.254.126.122", "src_port": 40446, "dest_port": 80}}');
INSERT INTO alerts VALUES(720,1772995975.278806925,'{"timestamp": "2026-03-08T19:52:55.278807+0100", "flow_id": 2041894030284169, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 54209, "dest_ip": "185.254.126.122", "dest_port": 46340, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:52:55.278807+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 54209, "dest_port": 46340}}');
INSERT INTO alerts VALUES(721,1772996102.873090983,'{"timestamp": "2026-03-08T19:55:02.873091+0100", "flow_id": 1779573171549915, "event_type": "alert", "src_ip": "205.210.31.108", "src_port": 50167, "dest_ip": "185.254.126.122", "dest_port": 4786, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:55:02.873091+0100", "src_ip": "205.210.31.108", "dest_ip": "185.254.126.122", "src_port": 50167, "dest_port": 4786}}');
INSERT INTO alerts VALUES(722,1772996137.16129899,'{"timestamp": "2026-03-08T19:55:37.161299+0100", "flow_id": 411299847634752, "event_type": "alert", "src_ip": "87.121.84.57", "src_port": 34173, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:55:37.161299+0100", "src_ip": "87.121.84.57", "dest_ip": "185.254.126.122", "src_port": 34173, "dest_port": 3000}}');
INSERT INTO alerts VALUES(723,1772996142.908061027,'{"timestamp": "2026-03-08T19:55:42.908061+0100", "flow_id": 1929768328941158, "event_type": "alert", "src_ip": "167.94.138.108", "src_port": 14340, "dest_ip": "185.254.126.122", "dest_port": 53408, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T19:55:42.908061+0100", "src_ip": "167.94.138.108", "dest_ip": "185.254.126.122", "src_port": 14340, "dest_port": 53408}}');
INSERT INTO alerts VALUES(724,1772996151.800087928,'{"timestamp": "2026-03-08T19:55:51.800088+0100", "flow_id": 2028978078139666, "event_type": "alert", "src_ip": "193.163.125.13", "src_port": 33726, "dest_ip": "185.254.126.122", "dest_port": 5050, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:55:51.800088+0100", "src_ip": "193.163.125.13", "dest_ip": "185.254.126.122", "src_port": 33726, "dest_port": 5050}}');
INSERT INTO alerts VALUES(725,1772996225.914457083,'{"timestamp": "2026-03-08T19:57:05.914457+0100", "flow_id": 549864885853427, "event_type": "alert", "src_ip": "147.185.132.195", "src_port": 55140, "dest_ip": "185.254.126.122", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:57:05.914457+0100", "src_ip": "147.185.132.195", "dest_ip": "185.254.126.122", "src_port": 55140, "dest_port": 10001}}');
INSERT INTO alerts VALUES(726,1772996229.627072095,'{"timestamp": "2026-03-08T19:57:09.627072+0100", "flow_id": 1567356305734413, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 51344, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:57:09.627072+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 51344}}');
INSERT INTO alerts VALUES(727,1772996229.627072095,'{"timestamp": "2026-03-08T19:57:09.627072+0100", "flow_id": 1567356305734413, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 51344, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:57:09.627072+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 51344}}');
INSERT INTO alerts VALUES(728,1772996254.011209965,'{"timestamp": "2026-03-08T19:57:34.011210+0100", "flow_id": 1736997186493480, "event_type": "alert", "src_ip": "193.163.125.21", "src_port": 59714, "dest_ip": "185.254.126.122", "dest_port": 21288, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:57:34.011210+0100", "src_ip": "193.163.125.21", "dest_ip": "185.254.126.122", "src_port": 59714, "dest_port": 21288}}');
INSERT INTO alerts VALUES(729,1772996269.844784975,'{"timestamp": "2026-03-08T19:57:49.844785+0100", "flow_id": 1658002276107246, "event_type": "alert", "src_ip": "158.94.211.212", "src_port": 49628, "dest_ip": "185.254.126.122", "dest_port": 465, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400027, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 28", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T19:57:49.844785+0100", "src_ip": "158.94.211.212", "dest_ip": "185.254.126.122", "src_port": 49628, "dest_port": 465}}');
INSERT INTO alerts VALUES(730,1772996376.575364112,'{"timestamp": "2026-03-08T19:59:36.575364+0100", "flow_id": 219370311855865, "event_type": "alert", "src_ip": "45.142.154.98", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T19:59:36.575364+0100", "src_ip": "45.142.154.98", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 23}}');
INSERT INTO alerts VALUES(731,1772996405.601342917,'{"timestamp": "2026-03-08T20:00:05.601343+0100", "flow_id": 1456852213209944, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 39756, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:00:05.601343+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 39756}}');
INSERT INTO alerts VALUES(732,1772996405.601342917,'{"timestamp": "2026-03-08T20:00:05.601343+0100", "flow_id": 1456852213209944, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 39756, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:00:05.601343+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 39756}}');
INSERT INTO alerts VALUES(733,1772996492.107547998,'{"timestamp": "2026-03-08T20:01:32.107548+0100", "flow_id": 1306341031304806, "event_type": "alert", "src_ip": "205.210.31.193", "src_port": 56933, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:01:32.107548+0100", "src_ip": "205.210.31.193", "dest_ip": "185.254.126.122", "src_port": 56933, "dest_port": 27017}}');
INSERT INTO alerts VALUES(734,1772996494.720182895,'{"timestamp": "2026-03-08T20:01:34.720183+0100", "flow_id": 1967263239541011, "event_type": "alert", "src_ip": "205.210.31.86", "src_port": 53800, "dest_ip": "185.254.126.122", "dest_port": 8009, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:01:34.720183+0100", "src_ip": "205.210.31.86", "dest_ip": "185.254.126.122", "src_port": 53800, "dest_port": 8009}}');
INSERT INTO alerts VALUES(735,1772996552.119263888,'{"timestamp": "2026-03-08T20:02:32.119264+0100", "flow_id": 230762605347369, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 62467, "dest_ip": "185.254.126.122", "dest_port": 46615, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:02:32.119264+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 62467, "dest_port": 46615}}');
INSERT INTO alerts VALUES(736,1772996584.91255498,'{"timestamp": "2026-03-08T20:03:04.912555+0100", "flow_id": 260223470952068, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 12936, "dest_ip": "185.254.126.122", "dest_port": 44082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:03:04.912555+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 12936, "dest_port": 44082}}');
INSERT INTO alerts VALUES(737,1772996684.931451083,'{"timestamp": "2026-03-08T20:04:44.931451+0100", "flow_id": 1185803481267274, "event_type": "alert", "src_ip": "205.210.31.97", "src_port": 51048, "dest_ip": "185.254.126.122", "dest_port": 20256, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:04:44.931451+0100", "src_ip": "205.210.31.97", "dest_ip": "185.254.126.122", "src_port": 51048, "dest_port": 20256}}');
INSERT INTO alerts VALUES(738,1772996711.535727025,'{"timestamp": "2026-03-08T20:05:11.535727+0100", "flow_id": 2019457342658171, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 43038, "dest_ip": "185.254.126.122", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:05:11.535727+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 43038, "dest_port": 3001}}');
INSERT INTO alerts VALUES(739,1772996791.75694704,'{"timestamp": "2026-03-08T20:06:31.756947+0100", "flow_id": 2125164259265434, "event_type": "alert", "src_ip": "176.65.134.34", "src_port": 36079, "dest_ip": "185.254.126.122", "dest_port": 41000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:06:31.756947+0100", "src_ip": "176.65.134.34", "dest_ip": "185.254.126.122", "src_port": 36079, "dest_port": 41000}}');
INSERT INTO alerts VALUES(740,1772996845.495244027,'{"timestamp": "2026-03-08T20:07:25.495244+0100", "flow_id": 1564110791608796, "event_type": "alert", "src_ip": "147.185.132.46", "src_port": 49372, "dest_ip": "185.254.126.122", "dest_port": 1028, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:07:25.495244+0100", "src_ip": "147.185.132.46", "dest_ip": "185.254.126.122", "src_port": 49372, "dest_port": 1028}}');
INSERT INTO alerts VALUES(741,1772996864.482892036,'{"timestamp": "2026-03-08T20:07:44.482892+0100", "flow_id": 103683964845137, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44314, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:07:44.482892+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44314}}');
INSERT INTO alerts VALUES(742,1772996882.562480926,'{"timestamp": "2026-03-08T20:08:02.562481+0100", "flow_id": 726989966029822, "event_type": "alert", "src_ip": "88.210.63.191", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 13443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:08:02.562481+0100", "src_ip": "88.210.63.191", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 13443}}');
INSERT INTO alerts VALUES(743,1772996885.466512918,'{"timestamp": "2026-03-08T20:08:05.466513+0100", "flow_id": 1440711732022966, "event_type": "alert", "src_ip": "147.185.132.168", "src_port": 53225, "dest_ip": "185.254.126.122", "dest_port": 51007, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:08:05.466513+0100", "src_ip": "147.185.132.168", "dest_ip": "185.254.126.122", "src_port": 53225, "dest_port": 51007}}');
INSERT INTO alerts VALUES(744,1772996972.48891306,'{"timestamp": "2026-03-08T20:09:32.488913+0100", "flow_id": 1255440667007108, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 58443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:09:32.488913+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 58443}}');
INSERT INTO alerts VALUES(745,1772997088.66712308,'{"timestamp": "2026-03-08T20:11:28.667123+0100", "flow_id": 50524781915977, "event_type": "alert", "src_ip": "205.210.31.204", "src_port": 55223, "dest_ip": "185.254.126.122", "dest_port": 50053, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:11:28.667123+0100", "src_ip": "205.210.31.204", "dest_ip": "185.254.126.122", "src_port": 55223, "dest_port": 50053}}');
INSERT INTO alerts VALUES(746,1772997109.152990103,'{"timestamp": "2026-03-08T20:11:49.152990+0100", "flow_id": 1501516185323735, "event_type": "alert", "src_ip": "194.50.16.198", "src_port": 5061, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 429, "bytes_toclient": 0, "start": "2026-03-08T20:11:49.152990+0100", "src_ip": "194.50.16.198", "dest_ip": "185.254.126.122", "src_port": 5061, "dest_port": 5060}}');
INSERT INTO alerts VALUES(747,1772997171.823653936,'{"timestamp": "2026-03-08T20:12:51.823654+0100", "flow_id": 1004293165852902, "event_type": "alert", "src_ip": "167.94.138.138", "src_port": 12598, "dest_ip": "185.254.126.122", "dest_port": 58000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:12:51.823654+0100", "src_ip": "167.94.138.138", "dest_ip": "185.254.126.122", "src_port": 12598, "dest_port": 58000}}');
INSERT INTO alerts VALUES(748,1772997184.848424912,'{"timestamp": "2026-03-08T20:13:04.848425+0100", "flow_id": 266260928340923, "event_type": "alert", "src_ip": "205.210.31.76", "src_port": 51390, "dest_ip": "185.254.126.122", "dest_port": 445, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:13:04.848425+0100", "src_ip": "205.210.31.76", "dest_ip": "185.254.126.122", "src_port": 51390, "dest_port": 445}}');
INSERT INTO alerts VALUES(749,1772997219.801706075,'{"timestamp": "2026-03-08T20:13:39.801706+0100", "flow_id": 910027322538218, "event_type": "alert", "src_ip": "205.210.31.69", "src_port": 53479, "dest_ip": "185.254.126.122", "dest_port": 28080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:13:39.801706+0100", "src_ip": "205.210.31.69", "dest_ip": "185.254.126.122", "src_port": 53479, "dest_port": 28080}}');
INSERT INTO alerts VALUES(750,1772997239.975716114,'{"timestamp": "2026-03-08T20:13:59.975716+0100", "flow_id": 2220346355366617, "event_type": "alert", "src_ip": "205.210.31.108", "src_port": 52969, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:13:59.975716+0100", "src_ip": "205.210.31.108", "dest_ip": "185.254.126.122", "src_port": 52969, "dest_port": 3306}}');
INSERT INTO alerts VALUES(751,1772997248.701220989,'{"timestamp": "2026-03-08T20:14:08.701221+0100", "flow_id": 196972684561080, "event_type": "alert", "src_ip": "66.132.153.150", "src_port": 50119, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:14:08.701221+0100", "src_ip": "66.132.153.150", "dest_ip": "185.254.126.122", "src_port": 50119, "dest_port": 1433}}');
INSERT INTO alerts VALUES(752,1772997248.701220989,'{"timestamp": "2026-03-08T20:14:08.701221+0100", "flow_id": 196972684561080, "event_type": "alert", "src_ip": "66.132.153.150", "src_port": 50119, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:14:08.701221+0100", "src_ip": "66.132.153.150", "dest_ip": "185.254.126.122", "src_port": 50119, "dest_port": 1433}}');
INSERT INTO alerts VALUES(753,1772997286.250861883,'{"timestamp": "2026-03-08T20:14:46.250862+0100", "flow_id": 1921871137269985, "event_type": "alert", "src_ip": "45.156.87.50", "src_port": 42281, "dest_ip": "185.254.126.122", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:14:46.250862+0100", "src_ip": "45.156.87.50", "dest_ip": "185.254.126.122", "src_port": 42281, "dest_port": 17000}}');
INSERT INTO alerts VALUES(754,1772997441.753115893,'{"timestamp": "2026-03-08T20:17:21.753116+0100", "flow_id": 419862370518168, "event_type": "alert", "src_ip": "64.89.161.53", "src_port": 43970, "dest_ip": "185.254.126.122", "dest_port": 10012, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:17:21.753116+0100", "src_ip": "64.89.161.53", "dest_ip": "185.254.126.122", "src_port": 43970, "dest_port": 10012}}');
INSERT INTO alerts VALUES(755,1772997502.619277955,'{"timestamp": "2026-03-08T20:18:22.619278+0100", "flow_id": 1815358068138418, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 50160, "dest_ip": "185.254.126.122", "dest_port": 117, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:18:22.619278+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 50160, "dest_port": 117}}');
INSERT INTO alerts VALUES(756,1772997506.929975987,'{"timestamp": "2026-03-08T20:18:26.929976+0100", "flow_id": 616519446360227, "event_type": "alert", "src_ip": "193.163.125.27", "src_port": 51525, "dest_ip": "185.254.126.122", "dest_port": 9108, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:18:26.929976+0100", "src_ip": "193.163.125.27", "dest_ip": "185.254.126.122", "src_port": 51525, "dest_port": 9108}}');
INSERT INTO alerts VALUES(757,1772997553.649799109,'{"timestamp": "2026-03-08T20:19:13.649799+0100", "flow_id": 539067846195583, "event_type": "alert", "src_ip": "205.210.31.250", "src_port": 54737, "dest_ip": "185.254.126.122", "dest_port": 88, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:19:13.649799+0100", "src_ip": "205.210.31.250", "dest_ip": "185.254.126.122", "src_port": 54737, "dest_port": 88}}');
INSERT INTO alerts VALUES(758,1772997653.057126998,'{"timestamp": "2026-03-08T20:20:53.057127+0100", "flow_id": 1652733917379011, "event_type": "alert", "src_ip": "45.153.34.32", "src_port": 57020, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:20:53.057127+0100", "src_ip": "45.153.34.32", "dest_ip": "185.254.126.122", "src_port": 57020, "dest_port": 3306}}');
INSERT INTO alerts VALUES(759,1772997668.052010059,'{"timestamp": "2026-03-08T20:21:08.052010+0100", "flow_id": 1349284990079907, "event_type": "alert", "src_ip": "205.210.31.101", "src_port": 56140, "dest_ip": "185.254.126.122", "dest_port": 5906, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:21:08.052010+0100", "src_ip": "205.210.31.101", "dest_ip": "185.254.126.122", "src_port": 56140, "dest_port": 5906}}');
INSERT INTO alerts VALUES(760,1772997875.889720916,'{"timestamp": "2026-03-08T20:24:35.889721+0100", "flow_id": 1006574063480828, "event_type": "alert", "src_ip": "147.185.132.117", "src_port": 49454, "dest_ip": "185.254.126.122", "dest_port": 9000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:24:35.889721+0100", "src_ip": "147.185.132.117", "dest_ip": "185.254.126.122", "src_port": 49454, "dest_port": 9000}}');
INSERT INTO alerts VALUES(761,1772997973.92956996,'{"timestamp": "2026-03-08T20:26:13.929570+0100", "flow_id": 1459199818604061, "event_type": "alert", "src_ip": "64.89.163.148", "src_port": 57806, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:26:13.929570+0100", "src_ip": "64.89.163.148", "dest_ip": "185.254.126.122", "src_port": 57806, "dest_port": 3306}}');
INSERT INTO alerts VALUES(762,1772997973.92956996,'{"timestamp": "2026-03-08T20:26:13.929570+0100", "flow_id": 1459199818604061, "event_type": "alert", "src_ip": "64.89.163.148", "src_port": 57806, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:26:13.929570+0100", "src_ip": "64.89.163.148", "dest_ip": "185.254.126.122", "src_port": 57806, "dest_port": 3306}}');
INSERT INTO alerts VALUES(763,1772997995.695736885,'{"timestamp": "2026-03-08T20:26:35.695737+0100", "flow_id": 1017846658811533, "event_type": "alert", "src_ip": "147.185.132.237", "src_port": 53608, "dest_ip": "185.254.126.122", "dest_port": 4430, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:26:35.695737+0100", "src_ip": "147.185.132.237", "dest_ip": "185.254.126.122", "src_port": 53608, "dest_port": 4430}}');
INSERT INTO alerts VALUES(764,1772998161.8986969,'{"timestamp": "2026-03-08T20:29:21.898697+0100", "flow_id": 482175648961417, "event_type": "alert", "src_ip": "167.94.138.103", "src_port": 39796, "dest_ip": "185.254.126.122", "dest_port": 49104, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:29:21.898697+0100", "src_ip": "167.94.138.103", "dest_ip": "185.254.126.122", "src_port": 39796, "dest_port": 49104}}');
INSERT INTO alerts VALUES(765,1772998218.685156106,'{"timestamp": "2026-03-08T20:30:18.685156+0100", "flow_id": 690926288261454, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3435, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:30:18.685156+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3435}}');
INSERT INTO alerts VALUES(766,1772998239.273880958,'{"timestamp": "2026-03-08T20:30:39.273881+0100", "flow_id": 2020736748910707, "event_type": "alert", "src_ip": "167.94.146.41", "src_port": 35399, "dest_ip": "185.254.126.122", "dest_port": 30518, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:30:39.273881+0100", "src_ip": "167.94.146.41", "dest_ip": "185.254.126.122", "src_port": 35399, "dest_port": 30518}}');
INSERT INTO alerts VALUES(767,1772998292.600559949,'{"timestamp": "2026-03-08T20:31:32.600560+0100", "flow_id": 1172014882975356, "event_type": "alert", "src_ip": "43.228.157.19", "src_port": 57101, "dest_ip": "185.254.126.122", "dest_port": 12488, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:31:32.600560+0100", "src_ip": "43.228.157.19", "dest_ip": "185.254.126.122", "src_port": 57101, "dest_port": 12488}}');
INSERT INTO alerts VALUES(768,1772998312.940932036,'{"timestamp": "2026-03-08T20:31:52.940932+0100", "flow_id": 100624459371357, "event_type": "alert", "src_ip": "178.20.210.152", "src_port": 53204, "dest_ip": "185.254.126.122", "dest_port": 51922, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:31:52.940932+0100", "src_ip": "178.20.210.152", "dest_ip": "185.254.126.122", "src_port": 53204, "dest_port": 51922}}');
INSERT INTO alerts VALUES(769,1772998329.226285934,'{"timestamp": "2026-03-08T20:32:09.226286+0100", "flow_id": 408943425238904, "event_type": "alert", "src_ip": "87.121.84.88", "src_port": 60000, "dest_ip": "185.254.126.122", "dest_port": 22159, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:32:09.226286+0100", "src_ip": "87.121.84.88", "dest_ip": "185.254.126.122", "src_port": 60000, "dest_port": 22159}}');
INSERT INTO alerts VALUES(770,1772998352.373260022,'{"timestamp": "2026-03-08T20:32:32.373260+0100", "flow_id": 195767163409286, "event_type": "alert", "src_ip": "198.235.24.178", "src_port": 49519, "dest_ip": "185.254.126.122", "dest_port": 10010, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:32:32.373260+0100", "src_ip": "198.235.24.178", "dest_ip": "185.254.126.122", "src_port": 49519, "dest_port": 10010}}');
INSERT INTO alerts VALUES(771,1772998372.656402112,'{"timestamp": "2026-03-08T20:32:52.656402+0100", "flow_id": 1130378710830302, "event_type": "alert", "src_ip": "147.185.132.123", "src_port": 55789, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 408, "bytes_toclient": 0, "start": "2026-03-08T20:32:52.656402+0100", "src_ip": "147.185.132.123", "dest_ip": "185.254.126.122", "src_port": 55789, "dest_port": 5060}}');
INSERT INTO alerts VALUES(772,1772998425.448502063,'{"timestamp": "2026-03-08T20:33:45.448502+0100", "flow_id": 518927471432136, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 40097, "dest_ip": "185.254.126.122", "dest_port": 4521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:33:45.448502+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 40097, "dest_port": 4521}}');
INSERT INTO alerts VALUES(773,1772998450.716228009,'{"timestamp": "2026-03-08T20:34:10.716228+0100", "flow_id": 824378539492987, "event_type": "alert", "src_ip": "198.235.24.194", "src_port": 53807, "dest_ip": "185.254.126.122", "dest_port": 2002, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:34:10.716228+0100", "src_ip": "198.235.24.194", "dest_ip": "185.254.126.122", "src_port": 53807, "dest_port": 2002}}');
INSERT INTO alerts VALUES(774,1772998459.034542083,'{"timestamp": "2026-03-08T20:34:19.034542+0100", "flow_id": 992784708188846, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 52881, "dest_ip": "185.254.126.122", "dest_port": 2222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:34:19.034542+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 52881, "dest_port": 2222}}');
INSERT INTO alerts VALUES(775,1772998459.034542083,'{"timestamp": "2026-03-08T20:34:19.034542+0100", "flow_id": 992784708188846, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 52881, "dest_ip": "185.254.126.122", "dest_port": 2222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:34:19.034542+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 52881, "dest_port": 2222}}');
INSERT INTO alerts VALUES(776,1772998472.900187016,'{"timestamp": "2026-03-08T20:34:32.900187+0100", "flow_id": 207102695458352, "event_type": "alert", "src_ip": "45.153.34.187", "src_port": 48115, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:34:32.900187+0100", "src_ip": "45.153.34.187", "dest_ip": "185.254.126.122", "src_port": 48115, "dest_port": 80}}');
INSERT INTO alerts VALUES(777,1772998499.298300981,'{"timestamp": "2026-03-08T20:34:59.298301+0100", "flow_id": 999718308467617, "event_type": "alert", "src_ip": "198.235.24.84", "src_port": 51383, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 58, "bytes_toclient": 0, "start": "2026-03-08T20:34:59.298301+0100", "src_ip": "198.235.24.84", "dest_ip": "185.254.126.122", "src_port": 51383, "dest_port": 53}}');
INSERT INTO alerts VALUES(778,1772998499.298300981,'{"timestamp": "2026-03-08T20:34:59.298301+0100", "flow_id": 999718308467617, "event_type": "alert", "src_ip": "198.235.24.84", "src_port": 51383, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2101616, "rev": 9, "signature": "GPL DNS named version attempt", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_07_26"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 58, "bytes_toclient": 0, "start": "2026-03-08T20:34:59.298301+0100", "src_ip": "198.235.24.84", "dest_ip": "185.254.126.122", "src_port": 51383, "dest_port": 53}}');
INSERT INTO alerts VALUES(779,1772998533.51175499,'{"timestamp": "2026-03-08T20:35:33.511755+0100", "flow_id": 1635022550195106, "event_type": "alert", "src_ip": "185.242.226.67", "src_port": 58647, "dest_ip": "185.254.126.122", "dest_port": 5094, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-08T20:35:33.511755+0100", "src_ip": "185.242.226.67", "dest_ip": "185.254.126.122", "src_port": 58647, "dest_port": 5094}}');
INSERT INTO alerts VALUES(780,1772998583.889744997,'{"timestamp": "2026-03-08T20:36:23.889745+0100", "flow_id": 2132577887710045, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 14946, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:36:23.889745+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 14946}}');
INSERT INTO alerts VALUES(781,1772998644.377679109,'{"timestamp": "2026-03-08T20:37:24.377679+0100", "flow_id": 1340645385797722, "event_type": "alert", "src_ip": "185.242.226.68", "src_port": 55364, "dest_ip": "185.254.126.122", "dest_port": 7168, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-08T20:37:24.377679+0100", "src_ip": "185.242.226.68", "dest_ip": "185.254.126.122", "src_port": 55364, "dest_port": 7168}}');
INSERT INTO alerts VALUES(782,1772998661.298909903,'{"timestamp": "2026-03-08T20:37:41.298910+0100", "flow_id": 1565284007163642, "event_type": "alert", "src_ip": "193.163.125.10", "src_port": 53293, "dest_ip": "185.254.126.122", "dest_port": 21304, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:37:41.298910+0100", "src_ip": "193.163.125.10", "dest_ip": "185.254.126.122", "src_port": 53293, "dest_port": 21304}}');
INSERT INTO alerts VALUES(783,1772998664.902548074,'{"timestamp": "2026-03-08T20:37:44.902548+0100", "flow_id": 217243518296947, "event_type": "alert", "src_ip": "205.210.31.110", "src_port": 50005, "dest_ip": "185.254.126.122", "dest_port": 5632, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 30, "bytes_toclient": 0, "start": "2026-03-08T20:37:44.902548+0100", "src_ip": "205.210.31.110", "dest_ip": "185.254.126.122", "src_port": 50005, "dest_port": 5632}}');
INSERT INTO alerts VALUES(784,1772998664.902548074,'{"timestamp": "2026-03-08T20:37:44.902548+0100", "flow_id": 217243518296947, "event_type": "alert", "src_ip": "205.210.31.110", "src_port": 50005, "dest_ip": "185.254.126.122", "dest_port": 5632, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2100566, "rev": 5, "signature": "GPL POLICY PCAnywhere server response", "category": "Misc activity", "severity": 3, "metadata": {"created_at": ["2010_09_23"], "signature_severity": ["Unknown"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 30, "bytes_toclient": 0, "start": "2026-03-08T20:37:44.902548+0100", "src_ip": "205.210.31.110", "dest_ip": "185.254.126.122", "src_port": 50005, "dest_port": 5632}}');
INSERT INTO alerts VALUES(785,1772998823.979213954,'{"timestamp": "2026-03-08T20:40:23.979214+0100", "flow_id": 2235368527481141, "event_type": "alert", "src_ip": "147.185.132.201", "src_port": 49739, "dest_ip": "185.254.126.122", "dest_port": 3493, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:40:23.979214+0100", "src_ip": "147.185.132.201", "dest_ip": "185.254.126.122", "src_port": 49739, "dest_port": 3493}}');
INSERT INTO alerts VALUES(786,1772998875.909862042,'{"timestamp": "2026-03-08T20:41:15.909862+0100", "flow_id": 1093080409981966, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 53344, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:41:15.909862+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 53344, "dest_port": 8545}}');
INSERT INTO alerts VALUES(787,1772998875.909862042,'{"timestamp": "2026-03-08T20:41:15.909862+0100", "flow_id": 1093080409981966, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 53344, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:41:15.909862+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 53344, "dest_port": 8545}}');
INSERT INTO alerts VALUES(788,1772998889.200779915,'{"timestamp": "2026-03-08T20:41:29.200780+0100", "flow_id": 299397612773731, "event_type": "alert", "src_ip": "198.235.24.64", "src_port": 52922, "dest_ip": "185.254.126.122", "dest_port": 8085, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:41:29.200780+0100", "src_ip": "198.235.24.64", "dest_ip": "185.254.126.122", "src_port": 52922, "dest_port": 8085}}');
INSERT INTO alerts VALUES(789,1772998909.122773885,'{"timestamp": "2026-03-08T20:41:49.122774+0100", "flow_id": 1653212064884073, "event_type": "alert", "src_ip": "34.118.59.79", "src_port": 45432, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:41:49.122774+0100", "src_ip": "34.118.59.79", "dest_ip": "185.254.126.122", "src_port": 45432, "dest_port": 5432}}');
INSERT INTO alerts VALUES(790,1772998948.155320882,'{"timestamp": "2026-03-08T20:42:28.155321+0100", "flow_id": 1230051439840897, "event_type": "alert", "src_ip": "193.163.125.26", "src_port": 54850, "dest_ip": "185.254.126.122", "dest_port": 4911, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:42:28.155321+0100", "src_ip": "193.163.125.26", "dest_ip": "185.254.126.122", "src_port": 54850, "dest_port": 4911}}');
INSERT INTO alerts VALUES(791,1772998950.109698057,'{"timestamp": "2026-03-08T20:42:30.109698+0100", "flow_id": 1878528422583969, "event_type": "alert", "src_ip": "178.83.200.2", "src_port": 60000, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:42:30.109698+0100", "src_ip": "178.83.200.2", "dest_ip": "185.254.126.122", "src_port": 60000, "dest_port": 1433}}');
INSERT INTO alerts VALUES(792,1772998987.65840602,'{"timestamp": "2026-03-08T20:43:07.658406+0100", "flow_id": 857510773396117, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 62274, "dest_ip": "185.254.126.122", "dest_port": 1777, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:43:07.658406+0100", "src_ip": "167.94.146.38", "dest_ip": "185.254.126.122", "src_port": 62274, "dest_port": 1777}}');
INSERT INTO alerts VALUES(793,1772999037.644506931,'{"timestamp": "2026-03-08T20:43:57.644507+0100", "flow_id": 1642237451345932, "event_type": "alert", "src_ip": "192.109.200.220", "src_port": 58926, "dest_ip": "185.254.126.122", "dest_port": 672, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:43:57.644507+0100", "src_ip": "192.109.200.220", "dest_ip": "185.254.126.122", "src_port": 58926, "dest_port": 672}}');
INSERT INTO alerts VALUES(794,1772999120.439189911,'{"timestamp": "2026-03-08T20:45:20.439190+0100", "flow_id": 197457777519473, "event_type": "alert", "src_ip": "147.185.132.18", "src_port": 49523, "dest_ip": "185.254.126.122", "dest_port": 11495, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:45:20.439190+0100", "src_ip": "147.185.132.18", "dest_ip": "185.254.126.122", "src_port": 49523, "dest_port": 11495}}');
INSERT INTO alerts VALUES(795,1772999199.82663989,'{"timestamp": "2026-03-08T20:46:39.826640+0100", "flow_id": 2143018022521479, "event_type": "alert", "src_ip": "205.210.31.99", "src_port": 52762, "dest_ip": "185.254.126.122", "dest_port": 2096, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:46:39.826640+0100", "src_ip": "205.210.31.99", "dest_ip": "185.254.126.122", "src_port": 52762, "dest_port": 2096}}');
INSERT INTO alerts VALUES(796,1772999258.154313087,'{"timestamp": "2026-03-08T20:47:38.154313+0100", "flow_id": 662769522558595, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 45250, "dest_ip": "185.254.126.122", "dest_port": 24093, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:47:38.154313+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 45250, "dest_port": 24093}}');
INSERT INTO alerts VALUES(797,1772999280.865138054,'{"timestamp": "2026-03-08T20:48:00.865138+0100", "flow_id": 56568616660709, "event_type": "alert", "src_ip": "147.185.132.79", "src_port": 56440, "dest_ip": "185.254.126.122", "dest_port": 3905, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:48:00.865138+0100", "src_ip": "147.185.132.79", "dest_ip": "185.254.126.122", "src_port": 56440, "dest_port": 3905}}');
INSERT INTO alerts VALUES(798,1772999293.36255002,'{"timestamp": "2026-03-08T20:48:13.362550+0100", "flow_id": 1557142741790571, "event_type": "alert", "src_ip": "185.169.4.141", "src_port": 43176, "dest_ip": "185.254.126.122", "dest_port": 8728, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:48:13.362550+0100", "src_ip": "185.169.4.141", "dest_ip": "185.254.126.122", "src_port": 43176, "dest_port": 8728}}');
INSERT INTO alerts VALUES(799,1772999366.770520925,'{"timestamp": "2026-03-08T20:49:26.770521+0100", "flow_id": 1901990990743208, "event_type": "alert", "src_ip": "51.38.211.50", "src_port": 5283, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 440, "bytes_toclient": 0, "start": "2026-03-08T20:49:26.770521+0100", "src_ip": "51.38.211.50", "dest_ip": "185.254.126.122", "src_port": 5283, "dest_port": 5060}}');
INSERT INTO alerts VALUES(800,1772999366.770520925,'{"timestamp": "2026-03-08T20:49:26.770521+0100", "flow_id": 1901990990743208, "event_type": "alert", "src_ip": "51.38.211.50", "src_port": 5283, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 440, "bytes_toclient": 0, "start": "2026-03-08T20:49:26.770521+0100", "src_ip": "51.38.211.50", "dest_ip": "185.254.126.122", "src_port": 5283, "dest_port": 5060}}');
INSERT INTO alerts VALUES(801,1772999417.436831952,'{"timestamp": "2026-03-08T20:50:17.436832+0100", "flow_id": 468804538075288, "event_type": "alert", "src_ip": "198.235.24.120", "src_port": 51089, "dest_ip": "185.254.126.122", "dest_port": 5000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:50:17.436832+0100", "src_ip": "198.235.24.120", "dest_ip": "185.254.126.122", "src_port": 51089, "dest_port": 5000}}');
INSERT INTO alerts VALUES(802,1772999422.467606067,'{"timestamp": "2026-03-08T20:50:22.467606+0100", "flow_id": 1726877965599514, "event_type": "alert", "src_ip": "198.235.24.214", "src_port": 51013, "dest_ip": "185.254.126.122", "dest_port": 8991, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:50:22.467606+0100", "src_ip": "198.235.24.214", "dest_ip": "185.254.126.122", "src_port": 51013, "dest_port": 8991}}');
INSERT INTO alerts VALUES(803,1772999424.638678073,'{"timestamp": "2026-03-08T20:50:24.638678+0100", "flow_id": 209830056559657, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 59206, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:50:24.638678+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 59206, "dest_port": 8545}}');
INSERT INTO alerts VALUES(804,1772999424.638678073,'{"timestamp": "2026-03-08T20:50:24.638678+0100", "flow_id": 209830056559657, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 59206, "dest_ip": "185.254.126.122", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:50:24.638678+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 59206, "dest_port": 8545}}');
INSERT INTO alerts VALUES(805,1772999486.458863973,'{"timestamp": "2026-03-08T20:51:26.458864+0100", "flow_id": 1689331647456650, "event_type": "alert", "src_ip": "185.242.226.124", "src_port": 34905, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:51:26.458864+0100", "src_ip": "185.242.226.124", "dest_ip": "185.254.126.122", "src_port": 34905, "dest_port": 443}}');
INSERT INTO alerts VALUES(806,1772999499.279818058,'{"timestamp": "2026-03-08T20:51:39.279818+0100", "flow_id": 920336057831825, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 18128, "dest_ip": "185.254.126.122", "dest_port": 14028, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:51:39.279818+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 18128, "dest_port": 14028}}');
INSERT INTO alerts VALUES(807,1772999556.953968049,'{"timestamp": "2026-03-08T20:52:36.953968+0100", "flow_id": 1282514005703951, "event_type": "alert", "src_ip": "91.196.152.60", "src_port": 62901, "dest_ip": "185.254.126.122", "dest_port": 6666, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:52:36.953968+0100", "src_ip": "91.196.152.60", "dest_ip": "185.254.126.122", "src_port": 62901, "dest_port": 6666}}');
INSERT INTO alerts VALUES(808,1772999591.17789507,'{"timestamp": "2026-03-08T20:53:11.177895+0100", "flow_id": 2171430218613973, "event_type": "alert", "src_ip": "193.163.125.16", "src_port": 48175, "dest_ip": "185.254.126.122", "dest_port": 7810, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:53:11.177895+0100", "src_ip": "193.163.125.16", "dest_ip": "185.254.126.122", "src_port": 48175, "dest_port": 7810}}');
INSERT INTO alerts VALUES(809,1772999622.330562114,'{"timestamp": "2026-03-08T20:53:42.330562+0100", "flow_id": 1701228468999249, "event_type": "alert", "src_ip": "193.163.125.24", "src_port": 50127, "dest_ip": "185.254.126.122", "dest_port": 18789, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:53:42.330562+0100", "src_ip": "193.163.125.24", "dest_ip": "185.254.126.122", "src_port": 50127, "dest_port": 18789}}');
INSERT INTO alerts VALUES(810,1772999634.508399963,'{"timestamp": "2026-03-08T20:53:54.508400+0100", "flow_id": 776188488234778, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 58456, "dest_ip": "185.254.126.122", "dest_port": 31127, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:53:54.508400+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 58456, "dest_port": 31127}}');
INSERT INTO alerts VALUES(811,1772999684.83396697,'{"timestamp": "2026-03-08T20:54:44.833967+0100", "flow_id": 1330063822549151, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55728, "dest_ip": "185.254.126.122", "dest_port": 52377, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:54:44.833967+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 55728, "dest_port": 52377}}');
INSERT INTO alerts VALUES(812,1772999712.862467051,'{"timestamp": "2026-03-08T20:55:12.862467+0100", "flow_id": 45094831714094, "event_type": "alert", "src_ip": "91.196.152.52", "src_port": 45350, "dest_ip": "185.254.126.122", "dest_port": 6555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:55:12.862467+0100", "src_ip": "91.196.152.52", "dest_ip": "185.254.126.122", "src_port": 45350, "dest_port": 6555}}');
INSERT INTO alerts VALUES(813,1772999713.269915104,'{"timestamp": "2026-03-08T20:55:13.269915+0100", "flow_id": 314853982960998, "event_type": "alert", "src_ip": "167.94.146.39", "src_port": 34354, "dest_ip": "185.254.126.122", "dest_port": 30073, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:55:13.269915+0100", "src_ip": "167.94.146.39", "dest_ip": "185.254.126.122", "src_port": 34354, "dest_port": 30073}}');
INSERT INTO alerts VALUES(814,1772999726.915698052,'{"timestamp": "2026-03-08T20:55:26.915698+0100", "flow_id": 1962568580434563, "event_type": "alert", "src_ip": "205.210.31.246", "src_port": 55646, "dest_ip": "185.254.126.122", "dest_port": 8531, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:55:26.915698+0100", "src_ip": "205.210.31.246", "dest_ip": "185.254.126.122", "src_port": 55646, "dest_port": 8531}}');
INSERT INTO alerts VALUES(815,1772999742.440222978,'{"timestamp": "2026-03-08T20:55:42.440223+0100", "flow_id": 1890745734002408, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 56888, "dest_ip": "185.254.126.122", "dest_port": 29126, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T20:55:42.440223+0100", "src_ip": "167.94.146.46", "dest_ip": "185.254.126.122", "src_port": 56888, "dest_port": 29126}}');
INSERT INTO alerts VALUES(816,1772999752.614618063,'{"timestamp": "2026-03-08T20:55:52.614618+0100", "flow_id": 106489829896850, "event_type": "alert", "src_ip": "198.235.24.239", "src_port": 52815, "dest_ip": "185.254.126.122", "dest_port": 5557, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:55:52.614618+0100", "src_ip": "198.235.24.239", "dest_ip": "185.254.126.122", "src_port": 52815, "dest_port": 5557}}');
INSERT INTO alerts VALUES(817,1772999761.704051017,'{"timestamp": "2026-03-08T20:56:01.704051+0100", "flow_id": 490603867612433, "event_type": "alert", "src_ip": "45.142.154.10", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 59, "bytes_toclient": 0, "start": "2026-03-08T20:56:01.704051+0100", "src_ip": "45.142.154.10", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 53}}');
INSERT INTO alerts VALUES(818,1772999761.704051017,'{"timestamp": "2026-03-08T20:56:01.704051+0100", "flow_id": 490603867612433, "event_type": "alert", "src_ip": "45.142.154.10", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2101616, "rev": 9, "signature": "GPL DNS named version attempt", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_07_26"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 59, "bytes_toclient": 0, "start": "2026-03-08T20:56:01.704051+0100", "src_ip": "45.142.154.10", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 53}}');
INSERT INTO alerts VALUES(819,1772999774.202770948,'{"timestamp": "2026-03-08T20:56:14.202771+0100", "flow_id": 1715321596757082, "event_type": "alert", "src_ip": "198.235.24.105", "src_port": 55382, "dest_ip": "185.254.126.122", "dest_port": 1250, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:56:14.202771+0100", "src_ip": "198.235.24.105", "dest_ip": "185.254.126.122", "src_port": 55382, "dest_port": 1250}}');
INSERT INTO alerts VALUES(820,1772999839.075119972,'{"timestamp": "2026-03-08T20:57:19.075120+0100", "flow_id": 2011490273020592, "event_type": "alert", "src_ip": "198.235.24.238", "src_port": 53809, "dest_ip": "185.254.126.122", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ntp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 76, "bytes_toclient": 0, "start": "2026-03-08T20:57:19.075120+0100", "src_ip": "198.235.24.238", "dest_ip": "185.254.126.122", "src_port": 53809, "dest_port": 123}}');
INSERT INTO alerts VALUES(821,1772999871.089874982,'{"timestamp": "2026-03-08T20:57:51.089875+0100", "flow_id": 2074862678654929, "event_type": "alert", "src_ip": "198.235.24.223", "src_port": 53636, "dest_ip": "185.254.126.122", "dest_port": 67, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T20:57:51.089875+0100", "src_ip": "198.235.24.223", "dest_ip": "185.254.126.122", "src_port": 53636, "dest_port": 67}}');
INSERT INTO alerts VALUES(822,1772999902.069303036,'{"timestamp": "2026-03-08T20:58:22.069303+0100", "flow_id": 1705030498171194, "event_type": "alert", "src_ip": "40.124.186.155", "src_port": 43488, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T20:58:22.069303+0100", "src_ip": "40.124.186.155", "dest_ip": "185.254.126.122", "src_port": 43488, "dest_port": 5432}}');
INSERT INTO alerts VALUES(823,1772999984.759182929,'{"timestamp": "2026-03-08T20:59:44.759183+0100", "flow_id": 164442659652049, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 64011, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:59:44.759183+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 64011}}');
INSERT INTO alerts VALUES(824,1772999984.759182929,'{"timestamp": "2026-03-08T20:59:44.759183+0100", "flow_id": 164442659652049, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 64011, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T20:59:44.759183+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 64011}}');
INSERT INTO alerts VALUES(825,1773000048.654906988,'{"timestamp": "2026-03-08T21:00:48.654907+0100", "flow_id": 279531090946643, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 59498, "dest_ip": "185.254.126.122", "dest_port": 19531, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:00:48.654907+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 59498, "dest_port": 19531}}');
INSERT INTO alerts VALUES(826,1773000210.430327892,'{"timestamp": "2026-03-08T21:03:30.430328+0100", "flow_id": 722347399142952, "event_type": "alert", "src_ip": "79.124.62.178", "src_port": 59409, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:03:30.430328+0100", "src_ip": "79.124.62.178", "dest_ip": "185.254.126.122", "src_port": 59409, "dest_port": 8080}}');
INSERT INTO alerts VALUES(827,1773000288.252847909,'{"timestamp": "2026-03-08T21:04:48.252848+0100", "flow_id": 241550508015729, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "185.254.126.122", "dest_port": 27015, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 33, "bytes_toclient": 0, "start": "2026-03-08T21:04:48.252848+0100", "src_ip": "204.76.203.17", "dest_ip": "185.254.126.122", "src_port": 47534, "dest_port": 27015}}');
INSERT INTO alerts VALUES(828,1773000288.252847909,'{"timestamp": "2026-03-08T21:04:48.252848+0100", "flow_id": 241550508015729, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "185.254.126.122", "dest_port": 27015, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 33, "bytes_toclient": 0, "start": "2026-03-08T21:04:48.252848+0100", "src_ip": "204.76.203.17", "dest_ip": "185.254.126.122", "src_port": 47534, "dest_port": 27015}}');
INSERT INTO alerts VALUES(829,1773000292.136373997,'{"timestamp": "2026-03-08T21:04:52.136374+0100", "flow_id": 1148675425279345, "event_type": "alert", "src_ip": "205.210.31.215", "src_port": 51337, "dest_ip": "185.254.126.122", "dest_port": 3052, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:04:52.136374+0100", "src_ip": "205.210.31.215", "dest_ip": "185.254.126.122", "src_port": 51337, "dest_port": 3052}}');
INSERT INTO alerts VALUES(830,1773000300.019522905,'{"timestamp": "2026-03-08T21:05:00.019523+0100", "flow_id": 1209752666807396, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 53508, "dest_ip": "185.254.126.122", "dest_port": 56133, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:05:00.019523+0100", "src_ip": "167.94.146.35", "dest_ip": "185.254.126.122", "src_port": 53508, "dest_port": 56133}}');
INSERT INTO alerts VALUES(831,1773000407.651220083,'{"timestamp": "2026-03-08T21:06:47.651220+0100", "flow_id": 2234021054670795, "event_type": "alert", "src_ip": "198.235.24.211", "src_port": 56775, "dest_ip": "185.254.126.122", "dest_port": 17185, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 92, "bytes_toclient": 0, "start": "2026-03-08T21:06:47.651220+0100", "src_ip": "198.235.24.211", "dest_ip": "185.254.126.122", "src_port": 56775, "dest_port": 17185}}');
INSERT INTO alerts VALUES(832,1773000436.150711059,'{"timestamp": "2026-03-08T21:07:16.150711+0100", "flow_id": 1210250103460335, "event_type": "alert", "src_ip": "176.65.139.31", "src_port": 55705, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 67, "bytes_toclient": 0, "start": "2026-03-08T21:07:16.150711+0100", "src_ip": "176.65.139.31", "dest_ip": "185.254.126.122", "src_port": 55705, "dest_port": 389}}');
INSERT INTO alerts VALUES(833,1773000451.331151962,'{"timestamp": "2026-03-08T21:07:31.331152+0100", "flow_id": 859341020677356, "event_type": "alert", "src_ip": "193.163.125.34", "src_port": 43594, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:07:31.331152+0100", "src_ip": "193.163.125.34", "dest_ip": "185.254.126.122", "src_port": 43594, "dest_port": 5432}}');
INSERT INTO alerts VALUES(834,1773000451.331151962,'{"timestamp": "2026-03-08T21:07:31.331152+0100", "flow_id": 859341020677356, "event_type": "alert", "src_ip": "193.163.125.34", "src_port": 43594, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:07:31.331152+0100", "src_ip": "193.163.125.34", "dest_ip": "185.254.126.122", "src_port": 43594, "dest_port": 5432}}');
INSERT INTO alerts VALUES(835,1773000510.463222026,'{"timestamp": "2026-03-08T21:08:30.463222+0100", "flow_id": 1708052046650129, "event_type": "alert", "src_ip": "205.210.31.95", "src_port": 49623, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:08:30.463222+0100", "src_ip": "205.210.31.95", "dest_ip": "185.254.126.122", "src_port": 49623, "dest_port": 1521}}');
INSERT INTO alerts VALUES(836,1773000510.463222026,'{"timestamp": "2026-03-08T21:08:30.463222+0100", "flow_id": 1708052046650129, "event_type": "alert", "src_ip": "205.210.31.95", "src_port": 49623, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:08:30.463222+0100", "src_ip": "205.210.31.95", "dest_ip": "185.254.126.122", "src_port": 49623, "dest_port": 1521}}');
INSERT INTO alerts VALUES(837,1773000520.030508996,'{"timestamp": "2026-03-08T21:08:40.030509+0100", "flow_id": 131036094176599, "event_type": "alert", "src_ip": "205.210.31.94", "src_port": 49466, "dest_ip": "185.254.126.122", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:08:40.030509+0100", "src_ip": "205.210.31.94", "dest_ip": "185.254.126.122", "src_port": 49466, "dest_port": 10001}}');
INSERT INTO alerts VALUES(838,1773000530.197624921,'{"timestamp": "2026-03-08T21:08:50.197625+0100", "flow_id": 567318368786509, "event_type": "alert", "src_ip": "88.210.63.193", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 29443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:08:50.197625+0100", "src_ip": "88.210.63.193", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 29443}}');
INSERT INTO alerts VALUES(839,1773000551.469527007,'{"timestamp": "2026-03-08T21:09:11.469527+0100", "flow_id": 2016604708692043, "event_type": "alert", "src_ip": "51.178.100.208", "src_port": 5180, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 447, "bytes_toclient": 0, "start": "2026-03-08T21:09:11.469527+0100", "src_ip": "51.178.100.208", "dest_ip": "185.254.126.122", "src_port": 5180, "dest_port": 5060}}');
INSERT INTO alerts VALUES(840,1773000551.469527007,'{"timestamp": "2026-03-08T21:09:11.469527+0100", "flow_id": 2016604708692043, "event_type": "alert", "src_ip": "51.178.100.208", "src_port": 5180, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 447, "bytes_toclient": 0, "start": "2026-03-08T21:09:11.469527+0100", "src_ip": "51.178.100.208", "dest_ip": "185.254.126.122", "src_port": 5180, "dest_port": 5060}}');
INSERT INTO alerts VALUES(841,1773000659.263525962,'{"timestamp": "2026-03-08T21:10:59.263526+0100", "flow_id": 850364483492739, "event_type": "alert", "src_ip": "198.235.24.85", "src_port": 51260, "dest_ip": "185.254.126.122", "dest_port": 5001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:10:59.263526+0100", "src_ip": "198.235.24.85", "dest_ip": "185.254.126.122", "src_port": 51260, "dest_port": 5001}}');
INSERT INTO alerts VALUES(842,1773000733.047740936,'{"timestamp": "2026-03-08T21:12:13.047741+0100", "flow_id": 1612423624813312, "event_type": "alert", "src_ip": "185.241.208.163", "src_port": 50251, "dest_ip": "185.254.126.122", "dest_port": 3390, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:12:13.047741+0100", "src_ip": "185.241.208.163", "dest_ip": "185.254.126.122", "src_port": 50251, "dest_port": 3390}}');
INSERT INTO alerts VALUES(843,1773000818.565634966,'{"timestamp": "2026-03-08T21:13:38.565635+0100", "flow_id": 740534096271342, "event_type": "alert", "src_ip": "147.185.132.51", "src_port": 53118, "dest_ip": "185.254.126.122", "dest_port": 12546, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-08T21:13:38.565635+0100", "src_ip": "147.185.132.51", "dest_ip": "185.254.126.122", "src_port": 53118, "dest_port": 12546}}');
INSERT INTO alerts VALUES(844,1773000887.417045116,'{"timestamp": "2026-03-08T21:14:47.417045+0100", "flow_id": 2072670395668856, "event_type": "alert", "src_ip": "198.235.24.104", "src_port": 50014, "dest_ip": "185.254.126.122", "dest_port": 2484, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:14:47.417045+0100", "src_ip": "198.235.24.104", "dest_ip": "185.254.126.122", "src_port": 50014, "dest_port": 2484}}');
INSERT INTO alerts VALUES(845,1773000899.952703953,'{"timestamp": "2026-03-08T21:14:59.952704+0100", "flow_id": 995611890817458, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44376, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:14:59.952704+0100", "src_ip": "185.156.73.86", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44376}}');
INSERT INTO alerts VALUES(846,1773000961.56694889,'{"timestamp": "2026-03-08T21:16:01.566949+0100", "flow_id": 464706509701053, "event_type": "alert", "src_ip": "167.94.138.109", "src_port": 36863, "dest_ip": "185.254.126.122", "dest_port": 57359, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:16:01.566949+0100", "src_ip": "167.94.138.109", "dest_ip": "185.254.126.122", "src_port": 36863, "dest_port": 57359}}');
INSERT INTO alerts VALUES(847,1773001012.592196941,'{"timestamp": "2026-03-08T21:16:52.592197+0100", "flow_id": 1136093980051970, "event_type": "alert", "src_ip": "198.235.24.246", "src_port": 55500, "dest_ip": "185.254.126.122", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:16:52.592197+0100", "src_ip": "198.235.24.246", "dest_ip": "185.254.126.122", "src_port": 55500, "dest_port": 8081}}');
INSERT INTO alerts VALUES(848,1773001077.250709056,'{"timestamp": "2026-03-08T21:17:57.250709+0100", "flow_id": 1639740682245257, "event_type": "alert", "src_ip": "94.72.96.152", "src_port": 11983, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 437, "bytes_toclient": 0, "start": "2026-03-08T21:17:57.250709+0100", "src_ip": "94.72.96.152", "dest_ip": "185.254.126.122", "src_port": 11983, "dest_port": 5060}}');
INSERT INTO alerts VALUES(849,1773001077.250709056,'{"timestamp": "2026-03-08T21:17:57.250709+0100", "flow_id": 1639740682245257, "event_type": "alert", "src_ip": "94.72.96.152", "src_port": 11983, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 437, "bytes_toclient": 0, "start": "2026-03-08T21:17:57.250709+0100", "src_ip": "94.72.96.152", "dest_ip": "185.254.126.122", "src_port": 11983, "dest_port": 5060}}');
INSERT INTO alerts VALUES(850,1773001184.985579968,'{"timestamp": "2026-03-08T21:19:44.985580+0100", "flow_id": 10911952019887, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2086, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:19:44.985580+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2086}}');
INSERT INTO alerts VALUES(851,1773001184.985579968,'{"timestamp": "2026-03-08T21:19:44.985580+0100", "flow_id": 10911952019887, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2086, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:19:44.985580+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2086}}');
INSERT INTO alerts VALUES(852,1773001291.323080062,'{"timestamp": "2026-03-08T21:21:31.323080+0100", "flow_id": 1106144257797465, "event_type": "alert", "src_ip": "43.228.157.12", "src_port": 55402, "dest_ip": "185.254.126.122", "dest_port": 14822, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:21:31.323080+0100", "src_ip": "43.228.157.12", "dest_ip": "185.254.126.122", "src_port": 55402, "dest_port": 14822}}');
INSERT INTO alerts VALUES(853,1773001348.816839934,'{"timestamp": "2026-03-08T21:22:28.816840+0100", "flow_id": 1256502467926210, "event_type": "alert", "src_ip": "205.210.31.212", "src_port": 53789, "dest_ip": "185.254.126.122", "dest_port": 47001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:22:28.816840+0100", "src_ip": "205.210.31.212", "dest_ip": "185.254.126.122", "src_port": 53789, "dest_port": 47001}}');
INSERT INTO alerts VALUES(854,1773001444.17395711,'{"timestamp": "2026-03-08T21:24:04.173957+0100", "flow_id": 1310090952136629, "event_type": "alert", "src_ip": "185.242.226.33", "src_port": 44012, "dest_ip": "185.254.126.122", "dest_port": 587, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:24:04.173957+0100", "src_ip": "185.242.226.33", "dest_ip": "185.254.126.122", "src_port": 44012, "dest_port": 587}}');
INSERT INTO alerts VALUES(855,1773001463.76890397,'{"timestamp": "2026-03-08T21:24:23.768904+0100", "flow_id": 2176518673500987, "event_type": "alert", "src_ip": "147.185.132.40", "src_port": 53383, "dest_ip": "185.254.126.122", "dest_port": 5910, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:24:23.768904+0100", "src_ip": "147.185.132.40", "dest_ip": "185.254.126.122", "src_port": 53383, "dest_port": 5910}}');
INSERT INTO alerts VALUES(856,1773001498.4885149,'{"timestamp": "2026-03-08T21:24:58.488515+0100", "flow_id": 690783171567425, "event_type": "alert", "src_ip": "205.210.31.205", "src_port": 54094, "dest_ip": "185.254.126.122", "dest_port": 4506, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:24:58.488515+0100", "src_ip": "205.210.31.205", "dest_ip": "185.254.126.122", "src_port": 54094, "dest_port": 4506}}');
INSERT INTO alerts VALUES(857,1773001521.439667941,'{"timestamp": "2026-03-08T21:25:21.439668+0100", "flow_id": 480988356978230, "event_type": "alert", "src_ip": "64.89.163.82", "src_port": 41365, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:25:21.439668+0100", "src_ip": "64.89.163.82", "dest_ip": "185.254.126.122", "src_port": 41365, "dest_port": 5432}}');
INSERT INTO alerts VALUES(858,1773001521.439667941,'{"timestamp": "2026-03-08T21:25:21.439668+0100", "flow_id": 480988356978230, "event_type": "alert", "src_ip": "64.89.163.82", "src_port": 41365, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:25:21.439668+0100", "src_ip": "64.89.163.82", "dest_ip": "185.254.126.122", "src_port": 41365, "dest_port": 5432}}');
INSERT INTO alerts VALUES(859,1773001638.697171927,'{"timestamp": "2026-03-08T21:27:18.697172+0100", "flow_id": 1868435239802095, "event_type": "alert", "src_ip": "77.83.39.82", "src_port": 53386, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:27:18.697172+0100", "src_ip": "77.83.39.82", "dest_ip": "185.254.126.122", "src_port": 53386, "dest_port": 443}}');
INSERT INTO alerts VALUES(860,1773001676.775269032,'{"timestamp": "2026-03-08T21:27:56.775269+0100", "flow_id": 1359431671633563, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 58427, "dest_ip": "185.254.126.122", "dest_port": 12222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:27:56.775269+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 58427, "dest_port": 12222}}');
INSERT INTO alerts VALUES(861,1773001676.775269032,'{"timestamp": "2026-03-08T21:27:56.775269+0100", "flow_id": 1359431671633563, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 58427, "dest_ip": "185.254.126.122", "dest_port": 12222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:27:56.775269+0100", "src_ip": "185.242.246.37", "dest_ip": "185.254.126.122", "src_port": 58427, "dest_port": 12222}}');
INSERT INTO alerts VALUES(862,1773001740.444745063,'{"timestamp": "2026-03-08T21:29:00.444745+0100", "flow_id": 1347219033896759, "event_type": "alert", "src_ip": "45.142.154.99", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 9527, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:29:00.444745+0100", "src_ip": "45.142.154.99", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 9527}}');
INSERT INTO alerts VALUES(863,1773001828.102076054,'{"timestamp": "2026-03-08T21:30:28.102076+0100", "flow_id": 1282840970977878, "event_type": "alert", "src_ip": "167.94.146.33", "src_port": 41524, "dest_ip": "185.254.126.122", "dest_port": 43917, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:30:28.102076+0100", "src_ip": "167.94.146.33", "dest_ip": "185.254.126.122", "src_port": 41524, "dest_port": 43917}}');
INSERT INTO alerts VALUES(864,1773001875.949368953,'{"timestamp": "2026-03-08T21:31:15.949369+0100", "flow_id": 981286050465993, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 40549, "dest_ip": "185.254.126.122", "dest_port": 8082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:31:15.949369+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 40549, "dest_port": 8082}}');
INSERT INTO alerts VALUES(865,1773001875.949368953,'{"timestamp": "2026-03-08T21:31:15.949369+0100", "flow_id": 981286050465993, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 40549, "dest_ip": "185.254.126.122", "dest_port": 8082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:31:15.949369+0100", "src_ip": "185.242.246.38", "dest_ip": "185.254.126.122", "src_port": 40549, "dest_port": 8082}}');
INSERT INTO alerts VALUES(866,1773001878.015322923,'{"timestamp": "2026-03-08T21:31:18.015323+0100", "flow_id": 1754663350630532, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 50160, "dest_ip": "185.254.126.122", "dest_port": 119, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:31:18.015323+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 50160, "dest_port": 119}}');
INSERT INTO alerts VALUES(867,1773001879.805489064,'{"timestamp": "2026-03-08T21:31:19.805489+0100", "flow_id": 2052175000548871, "event_type": "alert", "src_ip": "167.94.138.193", "src_port": 24378, "dest_ip": "185.254.126.122", "dest_port": 8765, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:31:19.805489+0100", "src_ip": "167.94.138.193", "dest_ip": "185.254.126.122", "src_port": 24378, "dest_port": 8765}}');
INSERT INTO alerts VALUES(868,1773001925.547630072,'{"timestamp": "2026-03-08T21:32:05.547630+0100", "flow_id": 1507629578471698, "event_type": "alert", "src_ip": "147.185.132.210", "src_port": 57097, "dest_ip": "185.254.126.122", "dest_port": 40000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:32:05.547630+0100", "src_ip": "147.185.132.210", "dest_ip": "185.254.126.122", "src_port": 57097, "dest_port": 40000}}');
INSERT INTO alerts VALUES(869,1773001949.119525909,'{"timestamp": "2026-03-08T21:32:29.119526+0100", "flow_id": 1639260725615254, "event_type": "alert", "src_ip": "45.142.193.7", "src_port": 57202, "dest_ip": "185.254.126.122", "dest_port": 3462, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:32:29.119526+0100", "src_ip": "45.142.193.7", "dest_ip": "185.254.126.122", "src_port": 57202, "dest_port": 3462}}');
INSERT INTO alerts VALUES(870,1773002001.338432073,'{"timestamp": "2026-03-08T21:33:21.338432+0100", "flow_id": 327654744980200, "event_type": "alert", "src_ip": "87.121.84.57", "src_port": 58962, "dest_ip": "185.254.126.122", "dest_port": 9001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:33:21.338432+0100", "src_ip": "87.121.84.57", "dest_ip": "185.254.126.122", "src_port": 58962, "dest_port": 9001}}');
INSERT INTO alerts VALUES(871,1773002032.238178969,'{"timestamp": "2026-03-08T21:33:52.238179+0100", "flow_id": 178546516764162, "event_type": "alert", "src_ip": "205.210.31.203", "src_port": 56442, "dest_ip": "185.254.126.122", "dest_port": 2483, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:33:52.238179+0100", "src_ip": "205.210.31.203", "dest_ip": "185.254.126.122", "src_port": 56442, "dest_port": 2483}}');
INSERT INTO alerts VALUES(872,1773002122.575618983,'{"timestamp": "2026-03-08T21:35:22.575619+0100", "flow_id": 783418372770835, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 40097, "dest_ip": "185.254.126.122", "dest_port": 1010, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:35:22.575619+0100", "src_ip": "79.124.40.82", "dest_ip": "185.254.126.122", "src_port": 40097, "dest_port": 1010}}');
INSERT INTO alerts VALUES(873,1773002166.836678029,'{"timestamp": "2026-03-08T21:36:06.836678+0100", "flow_id": 1904655302515882, "event_type": "alert", "src_ip": "205.210.31.253", "src_port": 52454, "dest_ip": "185.254.126.122", "dest_port": 50070, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:36:06.836678+0100", "src_ip": "205.210.31.253", "dest_ip": "185.254.126.122", "src_port": 52454, "dest_port": 50070}}');
INSERT INTO alerts VALUES(874,1773002190.292949915,'{"timestamp": "2026-03-08T21:36:30.292950+0100", "flow_id": 1821164562903442, "event_type": "alert", "src_ip": "193.163.125.22", "src_port": 55884, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:36:30.292950+0100", "src_ip": "193.163.125.22", "dest_ip": "185.254.126.122", "src_port": 55884, "dest_port": 80}}');
INSERT INTO alerts VALUES(875,1773002254.208161115,'{"timestamp": "2026-03-08T21:37:34.208161+0100", "flow_id": 1738470543208034, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 11789, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:37:34.208161+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 11789}}');
INSERT INTO alerts VALUES(876,1773002392.600368976,'{"timestamp": "2026-03-08T21:39:52.600369+0100", "flow_id": 45293110465325, "event_type": "alert", "src_ip": "198.235.24.89", "src_port": 49368, "dest_ip": "185.254.126.122", "dest_port": 8333, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:39:52.600369+0100", "src_ip": "198.235.24.89", "dest_ip": "185.254.126.122", "src_port": 49368, "dest_port": 8333}}');
INSERT INTO alerts VALUES(877,1773002394.567814112,'{"timestamp": "2026-03-08T21:39:54.567814+0100", "flow_id": 749893004004277, "event_type": "alert", "src_ip": "185.242.226.104", "src_port": 49832, "dest_ip": "185.254.126.122", "dest_port": 41528, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:39:54.567814+0100", "src_ip": "185.242.226.104", "dest_ip": "185.254.126.122", "src_port": 49832, "dest_port": 41528}}');
INSERT INTO alerts VALUES(878,1773002402.101422072,'{"timestamp": "2026-03-08T21:40:02.101422+0100", "flow_id": 717082715551080, "event_type": "alert", "src_ip": "144.126.233.152", "src_port": 61006, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:40:02.101422+0100", "src_ip": "144.126.233.152", "dest_ip": "185.254.126.122", "src_port": 61006, "dest_port": 3306}}');
INSERT INTO alerts VALUES(879,1773002411.549103975,'{"timestamp": "2026-03-08T21:40:11.549104+0100", "flow_id": 951011467812325, "event_type": "alert", "src_ip": "185.156.73.182", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 501, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:40:11.549104+0100", "src_ip": "185.156.73.182", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 501}}');
INSERT INTO alerts VALUES(880,1773002415.857724906,'{"timestamp": "2026-03-08T21:40:15.857725+0100", "flow_id": 1995051867670584, "event_type": "alert", "src_ip": "176.65.134.20", "src_port": 36682, "dest_ip": "185.254.126.122", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:40:15.857725+0100", "src_ip": "176.65.134.20", "dest_ip": "185.254.126.122", "src_port": 36682, "dest_port": 443}}');
INSERT INTO alerts VALUES(881,1773002460.147497893,'{"timestamp": "2026-03-08T21:41:00.147498+0100", "flow_id": 1196452250925535, "event_type": "alert", "src_ip": "193.163.125.19", "src_port": 50032, "dest_ip": "185.254.126.122", "dest_port": 20303, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:41:00.147498+0100", "src_ip": "193.163.125.19", "dest_ip": "185.254.126.122", "src_port": 50032, "dest_port": 20303}}');
INSERT INTO alerts VALUES(882,1773002518.835189104,'{"timestamp": "2026-03-08T21:41:58.835189+0100", "flow_id": 1898262885654006, "event_type": "alert", "src_ip": "205.210.31.202", "src_port": 52947, "dest_ip": "185.254.126.122", "dest_port": 30083, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:41:58.835189+0100", "src_ip": "205.210.31.202", "dest_ip": "185.254.126.122", "src_port": 52947, "dest_port": 30083}}');
INSERT INTO alerts VALUES(883,1773002649.100522041,'{"timestamp": "2026-03-08T21:44:09.100522+0100", "flow_id": 431742319992047, "event_type": "alert", "src_ip": "167.94.146.44", "src_port": 55981, "dest_ip": "185.254.126.122", "dest_port": 52087, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:44:09.100522+0100", "src_ip": "167.94.146.44", "dest_ip": "185.254.126.122", "src_port": 55981, "dest_port": 52087}}');
INSERT INTO alerts VALUES(884,1773002667.695337057,'{"timestamp": "2026-03-08T21:44:27.695337+0100", "flow_id": 1016126382441745, "event_type": "alert", "src_ip": "198.235.24.196", "src_port": 50238, "dest_ip": "185.254.126.122", "dest_port": 49502, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:44:27.695337+0100", "src_ip": "198.235.24.196", "dest_ip": "185.254.126.122", "src_port": 50238, "dest_port": 49502}}');
INSERT INTO alerts VALUES(885,1773002755.655056953,'{"timestamp": "2026-03-08T21:45:55.655057+0100", "flow_id": 1124601928877673, "event_type": "alert", "src_ip": "147.185.132.97", "src_port": 52543, "dest_ip": "185.254.126.122", "dest_port": 1443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:45:55.655057+0100", "src_ip": "147.185.132.97", "dest_ip": "185.254.126.122", "src_port": 52543, "dest_port": 1443}}');
INSERT INTO alerts VALUES(886,1773002770.207225085,'{"timestamp": "2026-03-08T21:46:10.207225+0100", "flow_id": 608551145288114, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57175, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:46:10.207225+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57175, "dest_port": 8080}}');
INSERT INTO alerts VALUES(887,1773002770.207225085,'{"timestamp": "2026-03-08T21:46:10.207225+0100", "flow_id": 608551145288114, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57175, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:46:10.207225+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57175, "dest_port": 8080}}');
INSERT INTO alerts VALUES(888,1773002779.748446942,'{"timestamp": "2026-03-08T21:46:19.748447+0100", "flow_id": 962758160838117, "event_type": "alert", "src_ip": "167.94.138.146", "src_port": 29867, "dest_ip": "185.254.126.122", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 73, "bytes_toclient": 0, "start": "2026-03-08T21:46:19.748447+0100", "src_ip": "167.94.138.146", "dest_ip": "185.254.126.122", "src_port": 29867, "dest_port": 53}}');
INSERT INTO alerts VALUES(889,1773002848.435897111,'{"timestamp": "2026-03-08T21:47:28.435897+0100", "flow_id": 183314722659302, "event_type": "alert", "src_ip": "167.94.146.77", "src_port": 58726, "dest_ip": "185.254.126.122", "dest_port": 31389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:47:28.435897+0100", "src_ip": "167.94.146.77", "dest_ip": "185.254.126.122", "src_port": 58726, "dest_port": 31389}}');
INSERT INTO alerts VALUES(890,1773002850.275755882,'{"timestamp": "2026-03-08T21:47:30.275756+0100", "flow_id": 621414242167446, "event_type": "alert", "src_ip": "64.95.96.69", "src_port": 5186, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 433, "bytes_toclient": 0, "start": "2026-03-08T21:47:30.275756+0100", "src_ip": "64.95.96.69", "dest_ip": "185.254.126.122", "src_port": 5186, "dest_port": 5060}}');
INSERT INTO alerts VALUES(891,1773002850.275755882,'{"timestamp": "2026-03-08T21:47:30.275756+0100", "flow_id": 621414242167446, "event_type": "alert", "src_ip": "64.95.96.69", "src_port": 5186, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 433, "bytes_toclient": 0, "start": "2026-03-08T21:47:30.275756+0100", "src_ip": "64.95.96.69", "dest_ip": "185.254.126.122", "src_port": 5186, "dest_port": 5060}}');
INSERT INTO alerts VALUES(892,1773002891.92916298,'{"timestamp": "2026-03-08T21:48:11.929163+0100", "flow_id": 894500368299770, "event_type": "alert", "src_ip": "87.121.84.35", "src_port": 60001, "dest_ip": "185.254.126.122", "dest_port": 22140, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:48:11.929163+0100", "src_ip": "87.121.84.35", "dest_ip": "185.254.126.122", "src_port": 60001, "dest_port": 22140}}');
INSERT INTO alerts VALUES(893,1773002894.457967996,'{"timestamp": "2026-03-08T21:48:14.457968+0100", "flow_id": 1966961269001379, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 50351, "dest_ip": "185.254.126.122", "dest_port": 4001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:48:14.457968+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 50351, "dest_port": 4001}}');
INSERT INTO alerts VALUES(894,1773002949.910089015,'{"timestamp": "2026-03-08T21:49:09.910089+0100", "flow_id": 1657005950707951, "event_type": "alert", "src_ip": "64.95.96.68", "src_port": 5171, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 433, "bytes_toclient": 0, "start": "2026-03-08T21:49:09.910089+0100", "src_ip": "64.95.96.68", "dest_ip": "185.254.126.122", "src_port": 5171, "dest_port": 5060}}');
INSERT INTO alerts VALUES(895,1773002949.910089015,'{"timestamp": "2026-03-08T21:49:09.910089+0100", "flow_id": 1657005950707951, "event_type": "alert", "src_ip": "64.95.96.68", "src_port": 5171, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 433, "bytes_toclient": 0, "start": "2026-03-08T21:49:09.910089+0100", "src_ip": "64.95.96.68", "dest_ip": "185.254.126.122", "src_port": 5171, "dest_port": 5060}}');
INSERT INTO alerts VALUES(896,1773003019.665338993,'{"timestamp": "2026-03-08T21:50:19.665339+0100", "flow_id": 887287078027950, "event_type": "alert", "src_ip": "198.235.24.125", "src_port": 54968, "dest_ip": "185.254.126.122", "dest_port": 8443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:50:19.665339+0100", "src_ip": "198.235.24.125", "dest_ip": "185.254.126.122", "src_port": 54968, "dest_port": 8443}}');
INSERT INTO alerts VALUES(897,1773003095.670413018,'{"timestamp": "2026-03-08T21:51:35.670413+0100", "flow_id": 2034977853898582, "event_type": "alert", "src_ip": "147.185.132.183", "src_port": 50891, "dest_ip": "185.254.126.122", "dest_port": 4800, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 36, "bytes_toclient": 0, "start": "2026-03-08T21:51:35.670413+0100", "src_ip": "147.185.132.183", "dest_ip": "185.254.126.122", "src_port": 50891, "dest_port": 4800}}');
INSERT INTO alerts VALUES(898,1773003171.093499899,'{"timestamp": "2026-03-08T21:52:51.093500+0100", "flow_id": 964531418258600, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59755, "dest_ip": "185.254.126.122", "dest_port": 55830, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:52:51.093500+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59755, "dest_port": 55830}}');
INSERT INTO alerts VALUES(899,1773003171.093499899,'{"timestamp": "2026-03-08T21:52:51.093500+0100", "flow_id": 964531418258600, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59755, "dest_ip": "185.254.126.122", "dest_port": 55830, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:52:51.093500+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59755, "dest_port": 55830}}');
INSERT INTO alerts VALUES(900,1773003218.66376996,'{"timestamp": "2026-03-08T21:53:38.663770+0100", "flow_id": 599071415151565, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 56443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:53:38.663770+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 56443}}');
INSERT INTO alerts VALUES(901,1773003343.317548036,'{"timestamp": "2026-03-08T21:55:43.317548+0100", "flow_id": 2208286976710779, "event_type": "alert", "src_ip": "192.168.2.22", "src_port": 54911, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2026888, "rev": 4, "signature": "ET INFO DNS Query for Suspicious .icu Domain", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["Medium"], "created_at": ["2019_02_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_11_21"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 29028, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "prreqcroab.icu", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:55:43.317548+0100", "src_ip": "192.168.2.22", "dest_ip": "192.168.2.1", "src_port": 54911, "dest_port": 53}}');
INSERT INTO alerts VALUES(902,1773003354.570373059,'{"timestamp": "2026-03-08T21:55:54.570373+0100", "flow_id": 760884338336727, "event_type": "alert", "src_ip": "198.235.24.202", "src_port": 50246, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:55:54.570373+0100", "src_ip": "198.235.24.202", "dest_ip": "185.254.126.122", "src_port": 50246, "dest_port": 8080}}');
INSERT INTO alerts VALUES(903,1773003413.995872975,'{"timestamp": "2026-03-08T21:56:53.995873+0100", "flow_id": 1462495679305558, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 58456, "dest_ip": "185.254.126.122", "dest_port": 64479, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:56:53.995873+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 58456, "dest_port": 64479}}');
INSERT INTO alerts VALUES(904,1773003433.254703998,'{"timestamp": "2026-03-08T21:57:13.254704+0100", "flow_id": 530997271350417, "event_type": "alert", "src_ip": "205.210.31.230", "src_port": 51046, "dest_ip": "185.254.126.122", "dest_port": 23956, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:57:13.254704+0100", "src_ip": "205.210.31.230", "dest_ip": "185.254.126.122", "src_port": 51046, "dest_port": 23956}}');
INSERT INTO alerts VALUES(905,1773003484.635397911,'{"timestamp": "2026-03-08T21:58:04.635398+0100", "flow_id": 1321642489412512, "event_type": "alert", "src_ip": "167.94.146.47", "src_port": 18052, "dest_ip": "185.254.126.122", "dest_port": 2338, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T21:58:04.635398+0100", "src_ip": "167.94.146.47", "dest_ip": "185.254.126.122", "src_port": 18052, "dest_port": 2338}}');
INSERT INTO alerts VALUES(906,1773003494.241405963,'{"timestamp": "2026-03-08T21:58:14.241406+0100", "flow_id": 1881258402209316, "event_type": "alert", "src_ip": "89.248.163.200", "src_port": 40616, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T21:58:14.241406+0100", "src_ip": "89.248.163.200", "dest_ip": "185.254.126.122", "src_port": 40616, "dest_port": 5432}}');
INSERT INTO alerts VALUES(907,1773003531.64944005,'{"timestamp": "2026-03-08T21:58:51.649440+0100", "flow_id": 1100475142496223, "event_type": "alert", "src_ip": "64.89.163.244", "src_port": 43520, "dest_ip": "185.254.126.122", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:58:51.649440+0100", "src_ip": "64.89.163.244", "dest_ip": "185.254.126.122", "src_port": 43520, "dest_port": 27017}}');
INSERT INTO alerts VALUES(908,1773003543.653235913,'{"timestamp": "2026-03-08T21:59:03.653236+0100", "flow_id": 2242677341586102, "event_type": "alert", "src_ip": "205.210.31.245", "src_port": 51469, "dest_ip": "185.254.126.122", "dest_port": 50003, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T21:59:03.653236+0100", "src_ip": "205.210.31.245", "dest_ip": "185.254.126.122", "src_port": 51469, "dest_port": 50003}}');
INSERT INTO alerts VALUES(909,1773003670.707717895,'{"timestamp": "2026-03-08T22:01:10.707718+0100", "flow_id": 1913726095547699, "event_type": "alert", "src_ip": "147.185.132.60", "src_port": 53415, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:01:10.707718+0100", "src_ip": "147.185.132.60", "dest_ip": "185.254.126.122", "src_port": 53415, "dest_port": 8080}}');
INSERT INTO alerts VALUES(910,1773003707.49413395,'{"timestamp": "2026-03-08T22:01:47.494134+0100", "flow_id": 996391076238493, "event_type": "alert", "src_ip": "176.65.148.45", "src_port": 59161, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:01:47.494134+0100", "src_ip": "176.65.148.45", "dest_ip": "185.254.126.122", "src_port": 59161, "dest_port": 8080}}');
INSERT INTO alerts VALUES(911,1773003707.49413395,'{"timestamp": "2026-03-08T22:01:47.494134+0100", "flow_id": 996391076238493, "event_type": "alert", "src_ip": "176.65.148.45", "src_port": 59161, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:01:47.494134+0100", "src_ip": "176.65.148.45", "dest_ip": "185.254.126.122", "src_port": 59161, "dest_port": 8080}}');
INSERT INTO alerts VALUES(912,1773003714.757635116,'{"timestamp": "2026-03-08T22:01:54.757635+0100", "flow_id": 720744136707859, "event_type": "alert", "src_ip": "205.210.31.97", "src_port": 52894, "dest_ip": "185.254.126.122", "dest_port": 137, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 78, "bytes_toclient": 0, "start": "2026-03-08T22:01:54.757635+0100", "src_ip": "205.210.31.97", "dest_ip": "185.254.126.122", "src_port": 52894, "dest_port": 137}}');
INSERT INTO alerts VALUES(913,1773003739.778945923,'{"timestamp": "2026-03-08T22:02:19.778946+0100", "flow_id": 1093749354203016, "event_type": "alert", "src_ip": "195.184.76.156", "src_port": 536, "dest_ip": "185.254.126.122", "dest_port": 5800, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:02:19.778946+0100", "src_ip": "195.184.76.156", "dest_ip": "185.254.126.122", "src_port": 536, "dest_port": 5800}}');
INSERT INTO alerts VALUES(914,1773003787.215955972,'{"timestamp": "2026-03-08T22:03:07.215956+0100", "flow_id": 927527532171640, "event_type": "alert", "src_ip": "198.235.24.37", "src_port": 51694, "dest_ip": "185.254.126.122", "dest_port": 5907, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:03:07.215956+0100", "src_ip": "198.235.24.37", "dest_ip": "185.254.126.122", "src_port": 51694, "dest_port": 5907}}');
INSERT INTO alerts VALUES(915,1773003813.072511912,'{"timestamp": "2026-03-08T22:03:33.072512+0100", "flow_id": 1437340261133197, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 59325, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T22:03:33.072512+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 59325, "dest_port": 8332}}');
INSERT INTO alerts VALUES(916,1773003813.072511912,'{"timestamp": "2026-03-08T22:03:33.072512+0100", "flow_id": 1437340261133197, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 59325, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T22:03:33.072512+0100", "src_ip": "204.76.203.56", "dest_ip": "185.254.126.122", "src_port": 59325, "dest_port": 8332}}');
INSERT INTO alerts VALUES(917,1773003826.021477937,'{"timestamp": "2026-03-08T22:03:46.021478+0100", "flow_id": 655198719638203, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 54192, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:03:46.021478+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 54192}}');
INSERT INTO alerts VALUES(918,1773003826.021477937,'{"timestamp": "2026-03-08T22:03:46.021478+0100", "flow_id": 655198719638203, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 54192, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:03:46.021478+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 54192}}');
INSERT INTO alerts VALUES(919,1773003846.940499067,'{"timestamp": "2026-03-08T22:04:06.940499+0100", "flow_id": 1787613101843923, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 59498, "dest_ip": "185.254.126.122", "dest_port": 8412, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:04:06.940499+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 59498, "dest_port": 8412}}');
INSERT INTO alerts VALUES(920,1773003858.86244893,'{"timestamp": "2026-03-08T22:04:18.862449+0100", "flow_id": 607968129614838, "event_type": "alert", "src_ip": "205.210.31.217", "src_port": 51971, "dest_ip": "185.254.126.122", "dest_port": 8445, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:04:18.862449+0100", "src_ip": "205.210.31.217", "dest_ip": "185.254.126.122", "src_port": 51971, "dest_port": 8445}}');
INSERT INTO alerts VALUES(921,1773003896.574719906,'{"timestamp": "2026-03-08T22:04:56.574720+0100", "flow_id": 216607671397106, "event_type": "alert", "src_ip": "45.156.87.91", "src_port": 54243, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:04:56.574720+0100", "src_ip": "45.156.87.91", "dest_ip": "185.254.126.122", "src_port": 54243, "dest_port": 8080}}');
INSERT INTO alerts VALUES(922,1773003966.068377971,'{"timestamp": "2026-03-08T22:06:06.068378+0100", "flow_id": 1701056545358585, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 40742, "dest_ip": "185.254.126.122", "dest_port": 3981, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:06:06.068378+0100", "src_ip": "167.94.146.38", "dest_ip": "185.254.126.122", "src_port": 40742, "dest_port": 3981}}');
INSERT INTO alerts VALUES(923,1773003991.165781021,'{"timestamp": "2026-03-08T22:06:31.165781+0100", "flow_id": 2119402425058856, "event_type": "alert", "src_ip": "66.132.153.158", "src_port": 17279, "dest_ip": "185.254.126.122", "dest_port": 5901, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:06:31.165781+0100", "src_ip": "66.132.153.158", "dest_ip": "185.254.126.122", "src_port": 17279, "dest_port": 5901}}');
INSERT INTO alerts VALUES(924,1773004068.069283009,'{"timestamp": "2026-03-08T22:07:48.069283+0100", "flow_id": 1141993909369896, "event_type": "alert", "src_ip": "205.210.31.102", "src_port": 52554, "dest_ip": "185.254.126.122", "dest_port": 8090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:07:48.069283+0100", "src_ip": "205.210.31.102", "dest_ip": "185.254.126.122", "src_port": 52554, "dest_port": 8090}}');
INSERT INTO alerts VALUES(925,1773004092.562730073,'{"timestamp": "2026-03-08T22:08:12.562730+0100", "flow_id": 1291008270493738, "event_type": "alert", "src_ip": "195.184.76.148", "src_port": 31920, "dest_ip": "185.254.126.122", "dest_port": 541, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:08:12.562730+0100", "src_ip": "195.184.76.148", "dest_ip": "185.254.126.122", "src_port": 31920, "dest_port": 541}}');
INSERT INTO alerts VALUES(926,1773004128.827397109,'{"timestamp": "2026-03-08T22:08:48.827397+0100", "flow_id": 175944015512600, "event_type": "alert", "src_ip": "167.94.146.36", "src_port": 50376, "dest_ip": "185.254.126.122", "dest_port": 20189, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:08:48.827397+0100", "src_ip": "167.94.146.36", "dest_ip": "185.254.126.122", "src_port": 50376, "dest_port": 20189}}');
INSERT INTO alerts VALUES(927,1773004139.94330597,'{"timestamp": "2026-03-08T22:08:59.943306+0100", "flow_id": 955246164285355, "event_type": "alert", "src_ip": "205.210.31.75", "src_port": 52241, "dest_ip": "185.254.126.122", "dest_port": 58000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:08:59.943306+0100", "src_ip": "205.210.31.75", "dest_ip": "185.254.126.122", "src_port": 52241, "dest_port": 58000}}');
INSERT INTO alerts VALUES(928,1773004316.416183949,'{"timestamp": "2026-03-08T22:11:56.416184+0100", "flow_id": 1224549352463426, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 36456, "dest_ip": "185.254.126.122", "dest_port": 10465, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:11:56.416184+0100", "src_ip": "167.94.146.35", "dest_ip": "185.254.126.122", "src_port": 36456, "dest_port": 10465}}');
INSERT INTO alerts VALUES(929,1773004332.686954021,'{"timestamp": "2026-03-08T22:12:12.686954+0100", "flow_id": 1261596835044305, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 54954, "dest_ip": "185.254.126.122", "dest_port": 18080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:12:12.686954+0100", "src_ip": "193.142.146.230", "dest_ip": "185.254.126.122", "src_port": 54954, "dest_port": 18080}}');
INSERT INTO alerts VALUES(930,1773004334.369297028,'{"timestamp": "2026-03-08T22:12:14.369297+0100", "flow_id": 1867597445075942, "event_type": "alert", "src_ip": "206.189.202.0", "src_port": 36032, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:12:14.369297+0100", "src_ip": "206.189.202.0", "dest_ip": "185.254.126.122", "src_port": 36032, "dest_port": 1433}}');
INSERT INTO alerts VALUES(931,1773004387.516123057,'{"timestamp": "2026-03-08T22:13:07.516123+0100", "flow_id": 1090832703381184, "event_type": "alert", "src_ip": "198.235.24.105", "src_port": 51022, "dest_ip": "185.254.126.122", "dest_port": 68, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:13:07.516123+0100", "src_ip": "198.235.24.105", "dest_ip": "185.254.126.122", "src_port": 51022, "dest_port": 68}}');
INSERT INTO alerts VALUES(932,1773004456.927016019,'{"timestamp": "2026-03-08T22:14:16.927016+0100", "flow_id": 40857444730707, "event_type": "alert", "src_ip": "205.210.31.213", "src_port": 52546, "dest_ip": "185.254.126.122", "dest_port": 139, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:14:16.927016+0100", "src_ip": "205.210.31.213", "dest_ip": "185.254.126.122", "src_port": 52546, "dest_port": 139}}');
INSERT INTO alerts VALUES(933,1773004506.969816923,'{"timestamp": "2026-03-08T22:15:06.969817+0100", "flow_id": 787633752128804, "event_type": "alert", "src_ip": "176.65.149.234", "src_port": 59053, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:15:06.969817+0100", "src_ip": "176.65.149.234", "dest_ip": "185.254.126.122", "src_port": 59053, "dest_port": 80}}');
INSERT INTO alerts VALUES(934,1773004509.961007118,'{"timestamp": "2026-03-08T22:15:09.961007+0100", "flow_id": 1594222910805924, "event_type": "alert", "src_ip": "176.65.139.12", "src_port": 41926, "dest_ip": "185.254.126.122", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:15:09.961007+0100", "src_ip": "176.65.139.12", "dest_ip": "185.254.126.122", "src_port": 41926, "dest_port": 17000}}');
INSERT INTO alerts VALUES(935,1773004763.560708046,'{"timestamp": "2026-03-08T22:19:23.560708+0100", "flow_id": 1000849792610588, "event_type": "alert", "src_ip": "205.210.31.221", "src_port": 51671, "dest_ip": "185.254.126.122", "dest_port": 20000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:19:23.560708+0100", "src_ip": "205.210.31.221", "dest_ip": "185.254.126.122", "src_port": 51671, "dest_port": 20000}}');
INSERT INTO alerts VALUES(936,1773004780.319046974,'{"timestamp": "2026-03-08T22:19:40.319047+0100", "flow_id": 1370296865767757, "event_type": "alert", "src_ip": "193.163.125.32", "src_port": 49382, "dest_ip": "185.254.126.122", "dest_port": 20247, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:19:40.319047+0100", "src_ip": "193.163.125.32", "dest_ip": "185.254.126.122", "src_port": 49382, "dest_port": 20247}}');
INSERT INTO alerts VALUES(937,1773004800.559807062,'{"timestamp": "2026-03-08T22:20:00.559807+0100", "flow_id": 152556404128371, "event_type": "alert", "src_ip": "45.153.34.187", "src_port": 42764, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:20:00.559807+0100", "src_ip": "45.153.34.187", "dest_ip": "185.254.126.122", "src_port": 42764, "dest_port": 80}}');
INSERT INTO alerts VALUES(938,1773004862.382163047,'{"timestamp": "2026-03-08T22:21:02.382163+0100", "flow_id": 1922854051334850, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 58556, "dest_ip": "185.254.126.122", "dest_port": 24299, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:21:02.382163+0100", "src_ip": "167.94.146.40", "dest_ip": "185.254.126.122", "src_port": 58556, "dest_port": 24299}}');
INSERT INTO alerts VALUES(939,1773004862.523571014,'{"timestamp": "2026-03-08T22:21:02.523571+0100", "flow_id": 1967247949100084, "event_type": "alert", "src_ip": "15.204.54.13", "src_port": 62250, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 445, "bytes_toclient": 0, "start": "2026-03-08T22:21:02.523571+0100", "src_ip": "15.204.54.13", "dest_ip": "185.254.126.122", "src_port": 62250, "dest_port": 5060}}');
INSERT INTO alerts VALUES(940,1773004862.523571014,'{"timestamp": "2026-03-08T22:21:02.523571+0100", "flow_id": 1967247949100084, "event_type": "alert", "src_ip": "15.204.54.13", "src_port": 62250, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 445, "bytes_toclient": 0, "start": "2026-03-08T22:21:02.523571+0100", "src_ip": "15.204.54.13", "dest_ip": "185.254.126.122", "src_port": 62250, "dest_port": 5060}}');
INSERT INTO alerts VALUES(941,1773004958.055551052,'{"timestamp": "2026-03-08T22:22:38.055551+0100", "flow_id": 1927440931164495, "event_type": "alert", "src_ip": "198.235.24.216", "src_port": 55570, "dest_ip": "185.254.126.122", "dest_port": 8015, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:22:38.055551+0100", "src_ip": "198.235.24.216", "dest_ip": "185.254.126.122", "src_port": 55570, "dest_port": 8015}}');
INSERT INTO alerts VALUES(942,1773005046.768431901,'{"timestamp": "2026-03-08T22:24:06.768432+0100", "flow_id": 1893017081101774, "event_type": "alert", "src_ip": "167.94.146.68", "src_port": 11611, "dest_ip": "185.254.126.122", "dest_port": 24948, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:24:06.768432+0100", "src_ip": "167.94.146.68", "dest_ip": "185.254.126.122", "src_port": 11611, "dest_port": 24948}}');
INSERT INTO alerts VALUES(943,1773005067.563940049,'{"timestamp": "2026-03-08T22:24:27.563940+0100", "flow_id": 1014730300635945, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 9072, "dest_ip": "185.254.126.122", "dest_port": 50653, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:24:27.563940+0100", "src_ip": "167.94.146.32", "dest_ip": "185.254.126.122", "src_port": 9072, "dest_port": 50653}}');
INSERT INTO alerts VALUES(944,1773005085.546555043,'{"timestamp": "2026-03-08T22:24:45.546555+0100", "flow_id": 1503011768814637, "event_type": "alert", "src_ip": "147.185.132.103", "src_port": 56950, "dest_ip": "185.254.126.122", "dest_port": 5353, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "mdns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 74, "bytes_toclient": 0, "start": "2026-03-08T22:24:45.546555+0100", "src_ip": "147.185.132.103", "dest_ip": "185.254.126.122", "src_port": 56950, "dest_port": 5353}}');
INSERT INTO alerts VALUES(945,1773005141.208935022,'{"timestamp": "2026-03-08T22:25:41.208935+0100", "flow_id": 1460322204544004, "event_type": "alert", "src_ip": "130.12.180.52", "src_port": 59044, "dest_ip": "185.254.126.122", "dest_port": 9090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:25:41.208935+0100", "src_ip": "130.12.180.52", "dest_ip": "185.254.126.122", "src_port": 59044, "dest_port": 9090}}');
INSERT INTO alerts VALUES(946,1773005141.208935022,'{"timestamp": "2026-03-08T22:25:41.208935+0100", "flow_id": 1460322204544004, "event_type": "alert", "src_ip": "130.12.180.52", "src_port": 59044, "dest_ip": "185.254.126.122", "dest_port": 9090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:25:41.208935+0100", "src_ip": "130.12.180.52", "dest_ip": "185.254.126.122", "src_port": 59044, "dest_port": 9090}}');
INSERT INTO alerts VALUES(947,1773005151.189318896,'{"timestamp": "2026-03-08T22:25:51.189319+0100", "flow_id": 2220497972334334, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 51186, "dest_ip": "185.254.126.122", "dest_port": 10602, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:25:51.189319+0100", "src_ip": "167.94.146.37", "dest_ip": "185.254.126.122", "src_port": 51186, "dest_port": 10602}}');
INSERT INTO alerts VALUES(948,1773005214.168171882,'{"timestamp": "2026-03-08T22:26:54.168172+0100", "flow_id": 1848193548369988, "event_type": "alert", "src_ip": "198.235.24.104", "src_port": 55051, "dest_ip": "185.254.126.122", "dest_port": 50067, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:26:54.168172+0100", "src_ip": "198.235.24.104", "dest_ip": "185.254.126.122", "src_port": 55051, "dest_port": 50067}}');
INSERT INTO alerts VALUES(949,1773005237.532979966,'{"timestamp": "2026-03-08T22:27:17.532980+0100", "flow_id": 1444708829725067, "event_type": "alert", "src_ip": "147.185.132.204", "src_port": 49881, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:27:17.532980+0100", "src_ip": "147.185.132.204", "dest_ip": "185.254.126.122", "src_port": 49881, "dest_port": 1521}}');
INSERT INTO alerts VALUES(950,1773005237.532979966,'{"timestamp": "2026-03-08T22:27:17.532980+0100", "flow_id": 1444708829725067, "event_type": "alert", "src_ip": "147.185.132.204", "src_port": 49881, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:27:17.532980+0100", "src_ip": "147.185.132.204", "dest_ip": "185.254.126.122", "src_port": 49881, "dest_port": 1521}}');
INSERT INTO alerts VALUES(951,1773005309.848690032,'{"timestamp": "2026-03-08T22:28:29.848690+0100", "flow_id": 1674772314498718, "event_type": "alert", "src_ip": "162.217.98.180", "src_port": 53388, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 413, "bytes_toclient": 0, "start": "2026-03-08T22:28:29.848690+0100", "src_ip": "162.217.98.180", "dest_ip": "185.254.126.122", "src_port": 53388, "dest_port": 5060}}');
INSERT INTO alerts VALUES(952,1773005322.676182986,'{"timestamp": "2026-03-08T22:28:42.676183+0100", "flow_id": 652384333363664, "event_type": "alert", "src_ip": "205.210.31.85", "src_port": 54852, "dest_ip": "185.254.126.122", "dest_port": 5903, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:28:42.676183+0100", "src_ip": "205.210.31.85", "dest_ip": "185.254.126.122", "src_port": 54852, "dest_port": 5903}}');
INSERT INTO alerts VALUES(953,1773005347.093836069,'{"timestamp": "2026-03-08T22:29:07.093836+0100", "flow_id": 965973732574379, "event_type": "alert", "src_ip": "45.142.154.87", "src_port": 58914, "dest_ip": "185.254.126.122", "dest_port": 3113, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:29:07.093836+0100", "src_ip": "45.142.154.87", "dest_ip": "185.254.126.122", "src_port": 58914, "dest_port": 3113}}');
INSERT INTO alerts VALUES(954,1773005375.656471968,'{"timestamp": "2026-03-08T22:29:35.656472+0100", "flow_id": 1975104234141603, "event_type": "alert", "src_ip": "147.185.132.94", "src_port": 50703, "dest_ip": "185.254.126.122", "dest_port": 9092, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:29:35.656472+0100", "src_ip": "147.185.132.94", "dest_ip": "185.254.126.122", "src_port": 50703, "dest_port": 9092}}');
INSERT INTO alerts VALUES(955,1773005459.63380909,'{"timestamp": "2026-03-08T22:30:59.633809+0100", "flow_id": 1033339702620230, "event_type": "alert", "src_ip": "205.210.31.38", "src_port": 55141, "dest_ip": "185.254.126.122", "dest_port": 20256, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:30:59.633809+0100", "src_ip": "205.210.31.38", "dest_ip": "185.254.126.122", "src_port": 55141, "dest_port": 20256}}');
INSERT INTO alerts VALUES(956,1773005535.462975979,'{"timestamp": "2026-03-08T22:32:15.462976+0100", "flow_id": 1988470755654220, "event_type": "alert", "src_ip": "168.76.20.229", "src_port": 47003, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400029, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 30", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:32:15.462976+0100", "src_ip": "168.76.20.229", "dest_ip": "185.254.126.122", "src_port": 47003, "dest_port": 80}}');
INSERT INTO alerts VALUES(957,1773005558.591506958,'{"timestamp": "2026-03-08T22:32:38.591507+0100", "flow_id": 1696081106780776, "event_type": "alert", "src_ip": "43.228.157.22", "src_port": 50904, "dest_ip": "185.254.126.122", "dest_port": 5435, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400003, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 4", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:32:38.591507+0100", "src_ip": "43.228.157.22", "dest_ip": "185.254.126.122", "src_port": 50904, "dest_port": 5435}}');
INSERT INTO alerts VALUES(958,1773005576.116995096,'{"timestamp": "2026-03-08T22:32:56.116995+0100", "flow_id": 221015079425583, "event_type": "alert", "src_ip": "176.65.139.31", "src_port": 22383, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ldap", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 67, "bytes_toclient": 0, "start": "2026-03-08T22:32:56.116995+0100", "src_ip": "176.65.139.31", "dest_ip": "185.254.126.122", "src_port": 22383, "dest_port": 389}}');
INSERT INTO alerts VALUES(959,1773005579.224474906,'{"timestamp": "2026-03-08T22:32:59.224475+0100", "flow_id": 964114706272224, "event_type": "alert", "src_ip": "198.235.24.80", "src_port": 56188, "dest_ip": "185.254.126.122", "dest_port": 389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:32:59.224475+0100", "src_ip": "198.235.24.80", "dest_ip": "185.254.126.122", "src_port": 56188, "dest_port": 389}}');
INSERT INTO alerts VALUES(960,1773005655.642452956,'{"timestamp": "2026-03-08T22:34:15.642453+0100", "flow_id": 2196367603824396, "event_type": "alert", "src_ip": "198.235.24.246", "src_port": 51106, "dest_ip": "185.254.126.122", "dest_port": 118, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:34:15.642453+0100", "src_ip": "198.235.24.246", "dest_ip": "185.254.126.122", "src_port": 51106, "dest_port": 118}}');
INSERT INTO alerts VALUES(961,1773005759.887775898,'{"timestamp": "2026-03-08T22:35:59.887776+0100", "flow_id": 2124119937136867, "event_type": "alert", "src_ip": "198.235.24.71", "src_port": 55699, "dest_ip": "185.254.126.122", "dest_port": 8159, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:35:59.887776+0100", "src_ip": "198.235.24.71", "dest_ip": "185.254.126.122", "src_port": 55699, "dest_port": 8159}}');
INSERT INTO alerts VALUES(962,1773005779.488178968,'{"timestamp": "2026-03-08T22:36:19.488179+0100", "flow_id": 970813762028675, "event_type": "alert", "src_ip": "193.163.125.9", "src_port": 41794, "dest_ip": "185.254.126.122", "dest_port": 61613, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:36:19.488179+0100", "src_ip": "193.163.125.9", "dest_ip": "185.254.126.122", "src_port": 41794, "dest_port": 61613}}');
INSERT INTO alerts VALUES(963,1773005834.597946882,'{"timestamp": "2026-03-08T22:37:14.597947+0100", "flow_id": 597841607736634, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 52453, "dest_ip": "185.254.126.122", "dest_port": 215, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:37:14.597947+0100", "src_ip": "167.94.146.46", "dest_ip": "185.254.126.122", "src_port": 52453, "dest_port": 215}}');
INSERT INTO alerts VALUES(964,1773005851.02057004,'{"timestamp": "2026-03-08T22:37:31.020570+0100", "flow_id": 932774492822416, "event_type": "alert", "src_ip": "176.65.148.95", "src_port": 38954, "dest_ip": "185.254.126.122", "dest_port": 12700, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:37:31.020570+0100", "src_ip": "176.65.148.95", "dest_ip": "185.254.126.122", "src_port": 38954, "dest_port": 12700}}');
INSERT INTO alerts VALUES(965,1773005851.02057004,'{"timestamp": "2026-03-08T22:37:31.020570+0100", "flow_id": 932774492822416, "event_type": "alert", "src_ip": "176.65.148.95", "src_port": 38954, "dest_ip": "185.254.126.122", "dest_port": 12700, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:37:31.020570+0100", "src_ip": "176.65.148.95", "dest_ip": "185.254.126.122", "src_port": 38954, "dest_port": 12700}}');
INSERT INTO alerts VALUES(966,1773005865.86975193,'{"timestamp": "2026-03-08T22:37:45.869752+0100", "flow_id": 357857695677273, "event_type": "alert", "src_ip": "198.235.24.198", "src_port": 49347, "dest_ip": "185.254.126.122", "dest_port": 8443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:37:45.869752+0100", "src_ip": "198.235.24.198", "dest_ip": "185.254.126.122", "src_port": 49347, "dest_port": 8443}}');
INSERT INTO alerts VALUES(967,1773005866.835855008,'{"timestamp": "2026-03-08T22:37:46.835855+0100", "flow_id": 775223713562937, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "185.254.126.122", "dest_port": 10892, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:37:46.835855+0100", "src_ip": "79.124.40.110", "dest_ip": "185.254.126.122", "src_port": 52537, "dest_port": 10892}}');
INSERT INTO alerts VALUES(968,1773005867.642081023,'{"timestamp": "2026-03-08T22:37:47.642081+0100", "flow_id": 1068868330600968, "event_type": "alert", "src_ip": "8.209.82.97", "src_port": 39549, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 79, "bytes_toclient": 0, "start": "2026-03-08T22:37:47.642081+0100", "src_ip": "8.209.82.97", "dest_ip": "185.254.126.122", "src_port": 39549, "dest_port": 161}}');
INSERT INTO alerts VALUES(969,1773005974.962225915,'{"timestamp": "2026-03-08T22:39:34.962226+0100", "flow_id": 1880929483397348, "event_type": "alert", "src_ip": "88.210.63.190", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44307, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:39:34.962226+0100", "src_ip": "88.210.63.190", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44307}}');
INSERT INTO alerts VALUES(970,1773006003.36602211,'{"timestamp": "2026-03-08T22:40:03.366022+0100", "flow_id": 1009103800541375, "event_type": "alert", "src_ip": "45.194.92.9", "src_port": 55662, "dest_ip": "185.254.126.122", "dest_port": 8080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:40:03.366022+0100", "src_ip": "45.194.92.9", "dest_ip": "185.254.126.122", "src_port": 55662, "dest_port": 8080}}');
INSERT INTO alerts VALUES(971,1773006074.415446997,'{"timestamp": "2026-03-08T22:41:14.415447+0100", "flow_id": 658433772511370, "event_type": "alert", "src_ip": "205.210.31.48", "src_port": 54835, "dest_ip": "185.254.126.122", "dest_port": 1900, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 125, "bytes_toclient": 0, "start": "2026-03-08T22:41:14.415447+0100", "src_ip": "205.210.31.48", "dest_ip": "185.254.126.122", "src_port": 54835, "dest_port": 1900}}');
INSERT INTO alerts VALUES(972,1773006084.07716608,'{"timestamp": "2026-03-08T22:41:24.077166+0100", "flow_id": 1175854580280873, "event_type": "alert", "src_ip": "167.94.138.159", "src_port": 18430, "dest_ip": "185.254.126.122", "dest_port": 11000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:41:24.077166+0100", "src_ip": "167.94.138.159", "dest_ip": "185.254.126.122", "src_port": 18430, "dest_port": 11000}}');
INSERT INTO alerts VALUES(973,1773006102.158776045,'{"timestamp": "2026-03-08T22:41:42.158776+0100", "flow_id": 1807841530734786, "event_type": "alert", "src_ip": "77.83.39.250", "src_port": 43514, "dest_ip": "185.254.126.122", "dest_port": 25, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:41:42.158776+0100", "src_ip": "77.83.39.250", "dest_ip": "185.254.126.122", "src_port": 43514, "dest_port": 25}}');
INSERT INTO alerts VALUES(974,1773006214.37113309,'{"timestamp": "2026-03-08T22:43:34.371133+0100", "flow_id": 1875479840358065, "event_type": "alert", "src_ip": "178.20.210.151", "src_port": 58715, "dest_ip": "185.254.126.122", "dest_port": 50000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:43:34.371133+0100", "src_ip": "178.20.210.151", "dest_ip": "185.254.126.122", "src_port": 58715, "dest_port": 50000}}');
INSERT INTO alerts VALUES(975,1773006248.218940019,'{"timestamp": "2026-03-08T22:44:08.218940+0100", "flow_id": 95915914579368, "event_type": "alert", "src_ip": "176.65.139.38", "src_port": 50000, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:44:08.218940+0100", "src_ip": "176.65.139.38", "dest_ip": "185.254.126.122", "src_port": 50000, "dest_port": 3000}}');
INSERT INTO alerts VALUES(976,1773006272.672164916,'{"timestamp": "2026-03-08T22:44:32.672165+0100", "flow_id": 72178729270393, "event_type": "alert", "src_ip": "198.235.24.109", "src_port": 51766, "dest_ip": "185.254.126.122", "dest_port": 5902, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:44:32.672165+0100", "src_ip": "198.235.24.109", "dest_ip": "185.254.126.122", "src_port": 51766, "dest_port": 5902}}');
INSERT INTO alerts VALUES(977,1773006448.488415957,'{"timestamp": "2026-03-08T22:47:28.488416+0100", "flow_id": 127408496651007, "event_type": "alert", "src_ip": "205.210.31.180", "src_port": 55255, "dest_ip": "185.254.126.122", "dest_port": 30005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:47:28.488416+0100", "src_ip": "205.210.31.180", "dest_ip": "185.254.126.122", "src_port": 55255, "dest_port": 30005}}');
INSERT INTO alerts VALUES(978,1773006450.41199398,'{"timestamp": "2026-03-08T22:47:30.411994+0100", "flow_id": 643602801248779, "event_type": "alert", "src_ip": "66.132.153.148", "src_port": 32863, "dest_ip": "185.254.126.122", "dest_port": 4443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:47:30.411994+0100", "src_ip": "66.132.153.148", "dest_ip": "185.254.126.122", "src_port": 32863, "dest_port": 4443}}');
INSERT INTO alerts VALUES(979,1773006541.978003025,'{"timestamp": "2026-03-08T22:49:01.978003+0100", "flow_id": 1667216581223212, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57175, "dest_ip": "185.254.126.122", "dest_port": 3128, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:49:01.978003+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57175, "dest_port": 3128}}');
INSERT INTO alerts VALUES(980,1773006541.978003025,'{"timestamp": "2026-03-08T22:49:01.978003+0100", "flow_id": 1667216581223212, "event_type": "alert", "src_ip": "176.65.148.2", "src_port": 57175, "dest_ip": "185.254.126.122", "dest_port": 3128, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:49:01.978003+0100", "src_ip": "176.65.148.2", "dest_ip": "185.254.126.122", "src_port": 57175, "dest_port": 3128}}');
INSERT INTO alerts VALUES(981,1773006559.697271108,'{"timestamp": "2026-03-08T22:49:19.697271+0100", "flow_id": 2150332670657688, "event_type": "alert", "src_ip": "205.210.31.82", "src_port": 54644, "dest_ip": "185.254.126.122", "dest_port": 3909, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:49:19.697271+0100", "src_ip": "205.210.31.82", "dest_ip": "185.254.126.122", "src_port": 54644, "dest_port": 3909}}');
INSERT INTO alerts VALUES(982,1773006560.496612072,'{"timestamp": "2026-03-08T22:49:20.496612+0100", "flow_id": 162608837861294, "event_type": "alert", "src_ip": "77.83.39.233", "src_port": 40794, "dest_ip": "185.254.126.122", "dest_port": 25, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400008, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 9", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:49:20.496612+0100", "src_ip": "77.83.39.233", "dest_ip": "185.254.126.122", "src_port": 40794, "dest_port": 25}}');
INSERT INTO alerts VALUES(983,1773006567.756881952,'{"timestamp": "2026-03-08T22:49:27.756882+0100", "flow_id": 2124884500178621, "event_type": "alert", "src_ip": "198.235.24.224", "src_port": 56201, "dest_ip": "185.254.126.122", "dest_port": 10250, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:49:27.756882+0100", "src_ip": "198.235.24.224", "dest_ip": "185.254.126.122", "src_port": 56201, "dest_port": 10250}}');
INSERT INTO alerts VALUES(984,1773006590.041455984,'{"timestamp": "2026-03-08T22:49:50.041456+0100", "flow_id": 1866903205975869, "event_type": "alert", "src_ip": "91.196.152.156", "src_port": 20452, "dest_ip": "185.254.126.122", "dest_port": 5800, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:49:50.041456+0100", "src_ip": "91.196.152.156", "dest_ip": "185.254.126.122", "src_port": 20452, "dest_port": 5800}}');
INSERT INTO alerts VALUES(985,1773006658.13653493,'{"timestamp": "2026-03-08T22:50:58.136535+0100", "flow_id": 586415178363643, "event_type": "alert", "src_ip": "205.210.31.89", "src_port": 49450, "dest_ip": "185.254.126.122", "dest_port": 5984, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:50:58.136535+0100", "src_ip": "205.210.31.89", "dest_ip": "185.254.126.122", "src_port": 49450, "dest_port": 5984}}');
INSERT INTO alerts VALUES(986,1773006799.929915904,'{"timestamp": "2026-03-08T22:53:19.929916+0100", "flow_id": 2023634237539429, "event_type": "alert", "src_ip": "178.20.210.152", "src_port": 44770, "dest_ip": "185.254.126.122", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:53:19.929916+0100", "src_ip": "178.20.210.152", "dest_ip": "185.254.126.122", "src_port": 44770, "dest_port": 10001}}');
INSERT INTO alerts VALUES(987,1773006950.182563067,'{"timestamp": "2026-03-08T22:55:50.182563+0100", "flow_id": 1910004626691522, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 17715, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:55:50.182563+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 17715}}');
INSERT INTO alerts VALUES(988,1773006950.182563067,'{"timestamp": "2026-03-08T22:55:50.182563+0100", "flow_id": 1910004626691522, "event_type": "alert", "src_ip": "176.65.148.70", "src_port": 59739, "dest_ip": "185.254.126.122", "dest_port": 17715, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:55:50.182563+0100", "src_ip": "176.65.148.70", "dest_ip": "185.254.126.122", "src_port": 59739, "dest_port": 17715}}');
INSERT INTO alerts VALUES(989,1773006969.549063921,'{"timestamp": "2026-03-08T22:56:09.549064+0100", "flow_id": 387890892059640, "event_type": "alert", "src_ip": "198.235.24.74", "src_port": 55465, "dest_ip": "185.254.126.122", "dest_port": 2082, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:56:09.549064+0100", "src_ip": "198.235.24.74", "dest_ip": "185.254.126.122", "src_port": 55465, "dest_port": 2082}}');
INSERT INTO alerts VALUES(990,1773007001.187442065,'{"timestamp": "2026-03-08T22:56:41.187442+0100", "flow_id": 523583130133735, "event_type": "alert", "src_ip": "198.235.24.212", "src_port": 56102, "dest_ip": "185.254.126.122", "dest_port": 5986, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:56:41.187442+0100", "src_ip": "198.235.24.212", "dest_ip": "185.254.126.122", "src_port": 56102, "dest_port": 5986}}');
INSERT INTO alerts VALUES(991,1773007025.649735928,'{"timestamp": "2026-03-08T22:57:05.649736+0100", "flow_id": 538795719014722, "event_type": "alert", "src_ip": "198.235.24.233", "src_port": 50869, "dest_ip": "185.254.126.122", "dest_port": 8888, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:57:05.649736+0100", "src_ip": "198.235.24.233", "dest_ip": "185.254.126.122", "src_port": 50869, "dest_port": 8888}}');
INSERT INTO alerts VALUES(992,1773007042.145338059,'{"timestamp": "2026-03-08T22:57:22.145338+0100", "flow_id": 624223805462588, "event_type": "alert", "src_ip": "176.65.134.34", "src_port": 35845, "dest_ip": "185.254.126.122", "dest_port": 4145, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T22:57:22.145338+0100", "src_ip": "176.65.134.34", "dest_ip": "185.254.126.122", "src_port": 35845, "dest_port": 4145}}');
INSERT INTO alerts VALUES(993,1773007045.877125978,'{"timestamp": "2026-03-08T22:57:25.877126+0100", "flow_id": 1515429378245217, "event_type": "alert", "src_ip": "45.135.194.48", "src_port": 38384, "dest_ip": "185.254.126.122", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T22:57:25.877126+0100", "src_ip": "45.135.194.48", "dest_ip": "185.254.126.122", "src_port": 38384, "dest_port": 5555}}');
INSERT INTO alerts VALUES(994,1773007088.297359943,'{"timestamp": "2026-03-08T22:58:08.297360+0100", "flow_id": 151255325445854, "event_type": "alert", "src_ip": "66.132.153.149", "src_port": 20542, "dest_ip": "185.254.126.122", "dest_port": 18100, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T22:58:08.297360+0100", "src_ip": "66.132.153.149", "dest_ip": "185.254.126.122", "src_port": 20542, "dest_port": 18100}}');
INSERT INTO alerts VALUES(995,1773007152.528796912,'{"timestamp": "2026-03-08T22:59:12.528797+0100", "flow_id": 19367454842372, "event_type": "alert", "src_ip": "198.235.24.166", "src_port": 55132, "dest_ip": "185.254.126.122", "dest_port": 943, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T22:59:12.528797+0100", "src_ip": "198.235.24.166", "dest_ip": "185.254.126.122", "src_port": 55132, "dest_port": 943}}');
INSERT INTO alerts VALUES(996,1773007256.16567707,'{"timestamp": "2026-03-08T23:00:56.165677+0100", "flow_id": 148629511585006, "event_type": "alert", "src_ip": "167.94.138.149", "src_port": 49694, "dest_ip": "185.254.126.122", "dest_port": 17185, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 92, "bytes_toclient": 0, "start": "2026-03-08T23:00:56.165677+0100", "src_ip": "167.94.138.149", "dest_ip": "185.254.126.122", "src_port": 49694, "dest_port": 17185}}');
INSERT INTO alerts VALUES(997,1773007272.42474103,'{"timestamp": "2026-03-08T23:01:12.424741+0100", "flow_id": 135400558444945, "event_type": "alert", "src_ip": "198.235.24.59", "src_port": 52332, "dest_ip": "185.254.126.122", "dest_port": 5222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:01:12.424741+0100", "src_ip": "198.235.24.59", "dest_ip": "185.254.126.122", "src_port": 52332, "dest_port": 5222}}');
INSERT INTO alerts VALUES(998,1773007278.296785117,'{"timestamp": "2026-03-08T23:01:18.296785+0100", "flow_id": 1837633754397747, "event_type": "alert", "src_ip": "167.94.146.43", "src_port": 4981, "dest_ip": "185.254.126.122", "dest_port": 38655, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:01:18.296785+0100", "src_ip": "167.94.146.43", "dest_ip": "185.254.126.122", "src_port": 4981, "dest_port": 38655}}');
INSERT INTO alerts VALUES(999,1773007400.497848034,'{"timestamp": "2026-03-08T23:03:20.497848+0100", "flow_id": 167916124534343, "event_type": "alert", "src_ip": "147.185.132.10", "src_port": 50851, "dest_ip": "185.254.126.122", "dest_port": 7080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:03:20.497848+0100", "src_ip": "147.185.132.10", "dest_ip": "185.254.126.122", "src_port": 50851, "dest_port": 7080}}');
INSERT INTO alerts VALUES(1000,1773007435.780380964,'{"timestamp": "2026-03-08T23:03:55.780381+0100", "flow_id": 1099911529154131, "event_type": "alert", "src_ip": "123.138.18.10", "src_port": 2507, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:03:55.780381+0100", "src_ip": "123.138.18.10", "dest_ip": "185.254.126.122", "src_port": 2507, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1001,1773007468.133311033,'{"timestamp": "2026-03-08T23:04:28.133311+0100", "flow_id": 1135517416723607, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 2501, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:04:28.133311+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 2501}}');
INSERT INTO alerts VALUES(1002,1773007468.133311033,'{"timestamp": "2026-03-08T23:04:28.133311+0100", "flow_id": 1135517416723607, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "185.254.126.122", "dest_port": 2501, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:04:28.133311+0100", "src_ip": "130.12.180.88", "dest_ip": "185.254.126.122", "src_port": 52302, "dest_port": 2501}}');
INSERT INTO alerts VALUES(1003,1773007485.969960928,'{"timestamp": "2026-03-08T23:04:45.969961+0100", "flow_id": 1632677438404557, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 44778, "dest_ip": "185.254.126.122", "dest_port": 32043, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:04:45.969961+0100", "src_ip": "79.124.62.134", "dest_ip": "185.254.126.122", "src_port": 44778, "dest_port": 32043}}');
INSERT INTO alerts VALUES(1004,1773007565.840790033,'{"timestamp": "2026-03-08T23:06:05.840790+0100", "flow_id": 1640840855492471, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 42686, "dest_ip": "185.254.126.122", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:06:05.840790+0100", "src_ip": "79.124.62.126", "dest_ip": "185.254.126.122", "src_port": 42686, "dest_port": 3389}}');
INSERT INTO alerts VALUES(1005,1773007608.823282003,'{"timestamp": "2026-03-08T23:06:48.823282+0100", "flow_id": 158269558620232, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 40962, "dest_ip": "185.254.126.122", "dest_port": 222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:06:48.823282+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 40962, "dest_port": 222}}');
INSERT INTO alerts VALUES(1006,1773007608.823282003,'{"timestamp": "2026-03-08T23:06:48.823282+0100", "flow_id": 158269558620232, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 40962, "dest_ip": "185.254.126.122", "dest_port": 222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:06:48.823282+0100", "src_ip": "185.242.246.36", "dest_ip": "185.254.126.122", "src_port": 40962, "dest_port": 222}}');
INSERT INTO alerts VALUES(1007,1773007638.119033098,'{"timestamp": "2026-03-08T23:07:18.119033+0100", "flow_id": 1918620332847162, "event_type": "alert", "src_ip": "167.94.146.44", "src_port": 5761, "dest_ip": "185.254.126.122", "dest_port": 1859, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:07:18.119033+0100", "src_ip": "167.94.146.44", "dest_ip": "185.254.126.122", "src_port": 5761, "dest_port": 1859}}');
INSERT INTO alerts VALUES(1008,1773007652.631706,'{"timestamp": "2026-03-08T23:07:32.631706+0100", "flow_id": 1305782721861832, "event_type": "alert", "src_ip": "185.169.4.141", "src_port": 52401, "dest_ip": "185.254.126.122", "dest_port": 8728, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:07:32.631706+0100", "src_ip": "185.169.4.141", "dest_ip": "185.254.126.122", "src_port": 52401, "dest_port": 8728}}');
INSERT INTO alerts VALUES(1009,1773007667.623893022,'{"timestamp": "2026-03-08T23:07:47.623893+0100", "flow_id": 990751887781628, "event_type": "alert", "src_ip": "167.94.138.108", "src_port": 11841, "dest_ip": "185.254.126.122", "dest_port": 43535, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:07:47.623893+0100", "src_ip": "167.94.138.108", "dest_ip": "185.254.126.122", "src_port": 11841, "dest_port": 43535}}');
INSERT INTO alerts VALUES(1010,1773007668.731547118,'{"timestamp": "2026-03-08T23:07:48.731547+0100", "flow_id": 1171649332809952, "event_type": "alert", "src_ip": "66.132.153.152", "src_port": 10239, "dest_ip": "185.254.126.122", "dest_port": 81, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:07:48.731547+0100", "src_ip": "66.132.153.152", "dest_ip": "185.254.126.122", "src_port": 10239, "dest_port": 81}}');
INSERT INTO alerts VALUES(1011,1773007672.244637012,'{"timestamp": "2026-03-08T23:07:52.244637+0100", "flow_id": 206284128917888, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 44338, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:07:52.244637+0100", "src_ip": "88.210.63.69", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 44338}}');
INSERT INTO alerts VALUES(1012,1773007755.090339899,'{"timestamp": "2026-03-08T23:09:15.090340+0100", "flow_id": 950959102861747, "event_type": "alert", "src_ip": "87.121.84.72", "src_port": 50160, "dest_ip": "185.254.126.122", "dest_port": 120, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:09:15.090340+0100", "src_ip": "87.121.84.72", "dest_ip": "185.254.126.122", "src_port": 50160, "dest_port": 120}}');
INSERT INTO alerts VALUES(1013,1773007850.307811022,'{"timestamp": "2026-03-08T23:10:50.307811+0100", "flow_id": 759090315938144, "event_type": "alert", "src_ip": "185.242.3.195", "src_port": 44950, "dest_ip": "185.254.126.122", "dest_port": 3022, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:10:50.307811+0100", "src_ip": "185.242.3.195", "dest_ip": "185.254.126.122", "src_port": 44950, "dest_port": 3022}}');
INSERT INTO alerts VALUES(1014,1773007893.099240065,'{"timestamp": "2026-03-08T23:11:33.099240+0100", "flow_id": 1552133946942565, "event_type": "alert", "src_ip": "176.65.149.180", "src_port": 47312, "dest_ip": "185.254.126.122", "dest_port": 8265, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:11:33.099240+0100", "src_ip": "176.65.149.180", "dest_ip": "185.254.126.122", "src_port": 47312, "dest_port": 8265}}');
INSERT INTO alerts VALUES(1015,1773007900.456829072,'{"timestamp": "2026-03-08T23:11:40.456829+0100", "flow_id": 1399118694843582, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 47746, "dest_ip": "185.254.126.122", "dest_port": 9619, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:11:40.456829+0100", "src_ip": "79.124.62.230", "dest_ip": "185.254.126.122", "src_port": 47746, "dest_port": 9619}}');
INSERT INTO alerts VALUES(1016,1773007946.533660889,'{"timestamp": "2026-03-08T23:12:26.533661+0100", "flow_id": 603209701124661, "event_type": "alert", "src_ip": "185.242.3.240", "src_port": 52569, "dest_ip": "185.254.126.122", "dest_port": 22164, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:12:26.533661+0100", "src_ip": "185.242.3.240", "dest_ip": "185.254.126.122", "src_port": 52569, "dest_port": 22164}}');
INSERT INTO alerts VALUES(1017,1773007954.066137076,'{"timestamp": "2026-03-08T23:12:34.066137+0100", "flow_id": 565532573064462, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2087, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:12:34.066137+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2087}}');
INSERT INTO alerts VALUES(1018,1773007954.066137076,'{"timestamp": "2026-03-08T23:12:34.066137+0100", "flow_id": 565532573064462, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "185.254.126.122", "dest_port": 2087, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:12:34.066137+0100", "src_ip": "204.76.203.215", "dest_ip": "185.254.126.122", "src_port": 40000, "dest_port": 2087}}');
INSERT INTO alerts VALUES(1019,1773008012.577930928,'{"timestamp": "2026-03-08T23:13:32.577931+0100", "flow_id": 1356298682409412, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 1398, "dest_ip": "185.254.126.122", "dest_port": 27248, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:13:32.577931+0100", "src_ip": "167.94.146.45", "dest_ip": "185.254.126.122", "src_port": 1398, "dest_port": 27248}}');
INSERT INTO alerts VALUES(1020,1773008148.714977025,'{"timestamp": "2026-03-08T23:15:48.714977+0100", "flow_id": 1381956529226361, "event_type": "alert", "src_ip": "193.163.125.38", "src_port": 20297, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-08T23:15:48.714977+0100", "src_ip": "193.163.125.38", "dest_ip": "185.254.126.122", "src_port": 20297, "dest_port": 161}}');
INSERT INTO alerts VALUES(1021,1773008148.714977025,'{"timestamp": "2026-03-08T23:15:48.714977+0100", "flow_id": 1381956529226361, "event_type": "alert", "src_ip": "193.163.125.38", "src_port": 20297, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-08T23:15:48.714977+0100", "src_ip": "193.163.125.38", "dest_ip": "185.254.126.122", "src_port": 20297, "dest_port": 161}}');
INSERT INTO alerts VALUES(1022,1773008151.71491003,'{"timestamp": "2026-03-08T23:15:51.714910+0100", "flow_id": 2226094404711335, "event_type": "alert", "src_ip": "193.163.125.73", "src_port": 21806, "dest_ip": "185.254.126.122", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 92, "bytes_toclient": 0, "start": "2026-03-08T23:15:51.714910+0100", "src_ip": "193.163.125.73", "dest_ip": "185.254.126.122", "src_port": 21806, "dest_port": 161}}');
INSERT INTO alerts VALUES(1023,1773008175.558007002,'{"timestamp": "2026-03-08T23:16:15.558007+0100", "flow_id": 2115150490571469, "event_type": "alert", "src_ip": "101.36.126.70", "src_port": 45858, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2500000, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:16:15.558007+0100", "src_ip": "101.36.126.70", "dest_ip": "185.254.126.122", "src_port": 45858, "dest_port": 80}}');
INSERT INTO alerts VALUES(1024,1773008260.708029031,'{"timestamp": "2026-03-08T23:17:40.708029+0100", "flow_id": 1352114151442066, "event_type": "alert", "src_ip": "81.29.142.50", "src_port": 60437, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:17:40.708029+0100", "src_ip": "81.29.142.50", "dest_ip": "185.254.126.122", "src_port": 60437, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1025,1773008263.896826029,'{"timestamp": "2026-03-08T23:17:43.896826+0100", "flow_id": 2162991355494921, "event_type": "alert", "src_ip": "176.65.149.45", "src_port": 40501, "dest_ip": "185.254.126.122", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:17:43.896826+0100", "src_ip": "176.65.149.45", "dest_ip": "185.254.126.122", "src_port": 40501, "dest_port": 8081}}');
INSERT INTO alerts VALUES(1026,1773008403.116923094,'{"timestamp": "2026-03-08T23:20:03.116923+0100", "flow_id": 1065134527206892, "event_type": "alert", "src_ip": "205.210.31.44", "src_port": 54224, "dest_ip": "185.254.126.122", "dest_port": 1723, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:20:03.116923+0100", "src_ip": "205.210.31.44", "dest_ip": "185.254.126.122", "src_port": 54224, "dest_port": 1723}}');
INSERT INTO alerts VALUES(1027,1773008404.344031095,'{"timestamp": "2026-03-08T23:20:04.344031+0100", "flow_id": 1196130275524313, "event_type": "alert", "src_ip": "198.235.24.226", "src_port": 56014, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:20:04.344031+0100", "src_ip": "198.235.24.226", "dest_ip": "185.254.126.122", "src_port": 56014, "dest_port": 22}}');
INSERT INTO alerts VALUES(1028,1773008427.530482054,'{"timestamp": "2026-03-08T23:20:27.530482+0100", "flow_id": 871030494122938, "event_type": "alert", "src_ip": "193.163.125.30", "src_port": 49874, "dest_ip": "185.254.126.122", "dest_port": 7170, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:20:27.530482+0100", "src_ip": "193.163.125.30", "dest_ip": "185.254.126.122", "src_port": 49874, "dest_port": 7170}}');
INSERT INTO alerts VALUES(1029,1773008547.398509026,'{"timestamp": "2026-03-08T23:22:27.398509+0100", "flow_id": 867160804260829, "event_type": "alert", "src_ip": "198.235.24.207", "src_port": 53726, "dest_ip": "185.254.126.122", "dest_port": 3390, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:22:27.398509+0100", "src_ip": "198.235.24.207", "dest_ip": "185.254.126.122", "src_port": 53726, "dest_port": 3390}}');
INSERT INTO alerts VALUES(1030,1773008586.644730092,'{"timestamp": "2026-03-08T23:23:06.644730+0100", "flow_id": 798769600475803, "event_type": "alert", "src_ip": "193.163.125.24", "src_port": 47483, "dest_ip": "185.254.126.122", "dest_port": 8008, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:23:06.644730+0100", "src_ip": "193.163.125.24", "dest_ip": "185.254.126.122", "src_port": 47483, "dest_port": 8008}}');
INSERT INTO alerts VALUES(1031,1773008599.603624106,'{"timestamp": "2026-03-08T23:23:19.603624+0100", "flow_id": 2029597880359255, "event_type": "alert", "src_ip": "205.210.31.54", "src_port": 49204, "dest_ip": "185.254.126.122", "dest_port": 1234, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:23:19.603624+0100", "src_ip": "205.210.31.54", "dest_ip": "185.254.126.122", "src_port": 49204, "dest_port": 1234}}');
INSERT INTO alerts VALUES(1032,1773008657.291300059,'{"timestamp": "2026-03-08T23:24:17.291300+0100", "flow_id": 406699166918733, "event_type": "alert", "src_ip": "176.65.134.3", "src_port": 51597, "dest_ip": "185.254.126.122", "dest_port": 5678, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:24:17.291300+0100", "src_ip": "176.65.134.3", "dest_ip": "185.254.126.122", "src_port": 51597, "dest_port": 5678}}');
INSERT INTO alerts VALUES(1033,1773008684.289740085,'{"timestamp": "2026-03-08T23:24:44.289740+0100", "flow_id": 1244425306806344, "event_type": "alert", "src_ip": "66.132.153.158", "src_port": 46959, "dest_ip": "185.254.126.122", "dest_port": 26257, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:24:44.289740+0100", "src_ip": "66.132.153.158", "dest_ip": "185.254.126.122", "src_port": 46959, "dest_port": 26257}}');
INSERT INTO alerts VALUES(1034,1773008724.937180043,'{"timestamp": "2026-03-08T23:25:24.937180+0100", "flow_id": 1210409805118424, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 59244, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T23:25:24.937180+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 59244, "dest_port": 8332}}');
INSERT INTO alerts VALUES(1035,1773008724.937180043,'{"timestamp": "2026-03-08T23:25:24.937180+0100", "flow_id": 1210409805118424, "event_type": "alert", "src_ip": "176.65.148.29", "src_port": 59244, "dest_ip": "185.254.126.122", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-08T23:25:24.937180+0100", "src_ip": "176.65.148.29", "dest_ip": "185.254.126.122", "src_port": 59244, "dest_port": 8332}}');
INSERT INTO alerts VALUES(1036,1773008790.673275947,'{"timestamp": "2026-03-08T23:26:30.673276+0100", "flow_id": 1765800471635846, "event_type": "alert", "src_ip": "147.185.132.42", "src_port": 56271, "dest_ip": "185.254.126.122", "dest_port": 23856, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:26:30.673276+0100", "src_ip": "147.185.132.42", "dest_ip": "185.254.126.122", "src_port": 56271, "dest_port": 23856}}');
INSERT INTO alerts VALUES(1037,1773008813.947158098,'{"timestamp": "2026-03-08T23:26:53.947158+0100", "flow_id": 1534740811047494, "event_type": "alert", "src_ip": "91.196.152.44", "src_port": 58241, "dest_ip": "185.254.126.122", "dest_port": 5672, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:26:53.947158+0100", "src_ip": "91.196.152.44", "dest_ip": "185.254.126.122", "src_port": 58241, "dest_port": 5672}}');
INSERT INTO alerts VALUES(1038,1773008814.390336036,'{"timestamp": "2026-03-08T23:26:54.390336+0100", "flow_id": 1957958172008631, "event_type": "alert", "src_ip": "198.235.24.47", "src_port": 55121, "dest_ip": "185.254.126.122", "dest_port": 9443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:26:54.390336+0100", "src_ip": "198.235.24.47", "dest_ip": "185.254.126.122", "src_port": 55121, "dest_port": 9443}}');
INSERT INTO alerts VALUES(1039,1773008836.426525116,'{"timestamp": "2026-03-08T23:27:16.426525+0100", "flow_id": 1268962680561209, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 55412, "dest_ip": "185.254.126.122", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:27:16.426525+0100", "src_ip": "91.224.92.177", "dest_ip": "185.254.126.122", "src_port": 55412, "dest_port": 3000}}');
INSERT INTO alerts VALUES(1040,1773008877.08996296,'{"timestamp": "2026-03-08T23:27:57.089963+0100", "flow_id": 1512292082407718, "event_type": "alert", "src_ip": "167.94.146.72", "src_port": 29019, "dest_ip": "185.254.126.122", "dest_port": 15337, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:27:57.089963+0100", "src_ip": "167.94.146.72", "dest_ip": "185.254.126.122", "src_port": 29019, "dest_port": 15337}}');
INSERT INTO alerts VALUES(1041,1773008920.970282077,'{"timestamp": "2026-03-08T23:28:40.970282+0100", "flow_id": 226682945776540, "event_type": "alert", "src_ip": "198.235.24.223", "src_port": 51198, "dest_ip": "185.254.126.122", "dest_port": 6379, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:28:40.970282+0100", "src_ip": "198.235.24.223", "dest_ip": "185.254.126.122", "src_port": 51198, "dest_port": 6379}}');
INSERT INTO alerts VALUES(1042,1773008928.766427993,'{"timestamp": "2026-03-08T23:28:48.766428+0100", "flow_id": 195560999723911, "event_type": "alert", "src_ip": "89.190.159.181", "src_port": 56662, "dest_ip": "185.254.126.122", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 438, "bytes_toclient": 0, "start": "2026-03-08T23:28:48.766428+0100", "src_ip": "89.190.159.181", "dest_ip": "185.254.126.122", "src_port": 56662, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1043,1773008938.936964036,'{"timestamp": "2026-03-08T23:28:58.936964+0100", "flow_id": 646533049175145, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 59834, "dest_ip": "185.254.126.122", "dest_port": 39060, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:28:58.936964+0100", "src_ip": "167.94.146.42", "dest_ip": "185.254.126.122", "src_port": 59834, "dest_port": 39060}}');
INSERT INTO alerts VALUES(1044,1773008960.13319993,'{"timestamp": "2026-03-08T23:29:20.133200+0100", "flow_id": 9140317461633, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "185.254.126.122", "dest_port": 64430, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:29:20.133200+0100", "src_ip": "185.156.73.86", "dest_ip": "185.254.126.122", "src_port": 55676, "dest_port": 64430}}');
INSERT INTO alerts VALUES(1045,1773008969.330980063,'{"timestamp": "2026-03-08T23:29:29.330980+0100", "flow_id": 295651778718485, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 50020, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:29:29.330980+0100", "src_ip": "45.156.87.127", "dest_ip": "185.254.126.122", "src_port": 50020, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1046,1773008969.330980063,'{"timestamp": "2026-03-08T23:29:29.330980+0100", "flow_id": 295651778718485, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 50020, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-08T23:29:29.330980+0100", "src_ip": "45.156.87.127", "dest_ip": "185.254.126.122", "src_port": 50020, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1047,1773008988.084927082,'{"timestamp": "2026-03-08T23:29:48.084927+0100", "flow_id": 1209186976401195, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 53540, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.084927+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 53540, "dest_port": 5432}}');
INSERT INTO alerts VALUES(1048,1773008988.208538056,'{"timestamp": "2026-03-08T23:29:48.208538+0100", "flow_id": 1177140330716117, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 52578, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.208538+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 52578, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1049,1773008988.389370918,'{"timestamp": "2026-03-08T23:29:48.389371+0100", "flow_id": 1390864605715648, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 59792, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.389371+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 59792, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1050,1773008988.608673095,'{"timestamp": "2026-03-08T23:29:48.608673+0100", "flow_id": 1206856937159214, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 47090, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.608673+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 47090, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1051,1773008989.13250804,'{"timestamp": "2026-03-08T23:29:49.132508+0100", "flow_id": 1209186976401195, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 53540, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 120, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.084927+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 53540, "dest_port": 5432}}');
INSERT INTO alerts VALUES(1052,1773008989.25961709,'{"timestamp": "2026-03-08T23:29:49.259617+0100", "flow_id": 1177140330716117, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 52578, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 120, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.208538+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 52578, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1053,1773008989.450006962,'{"timestamp": "2026-03-08T23:29:49.450007+0100", "flow_id": 1390864605715648, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 59792, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 120, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.389371+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 59792, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1054,1773008989.639754056,'{"timestamp": "2026-03-08T23:29:49.639754+0100", "flow_id": 1206856937159214, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 47090, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 120, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.608673+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 47090, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1055,1773008990.150948048,'{"timestamp": "2026-03-08T23:29:50.150948+0100", "flow_id": 1209186976401195, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 53540, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 0, "bytes_toserver": 180, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.084927+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 53540, "dest_port": 5432}}');
INSERT INTO alerts VALUES(1056,1773008990.278878928,'{"timestamp": "2026-03-08T23:29:50.278879+0100", "flow_id": 1177140330716117, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 52578, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 0, "bytes_toserver": 180, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.208538+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 52578, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1057,1773008990.469614029,'{"timestamp": "2026-03-08T23:29:50.469614+0100", "flow_id": 1390864605715648, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 59792, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 0, "bytes_toserver": 180, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.389371+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 59792, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1058,1773008990.669899941,'{"timestamp": "2026-03-08T23:29:50.669900+0100", "flow_id": 1206856937159214, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 47090, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 3, "pkts_toclient": 0, "bytes_toserver": 180, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.608673+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 47090, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1059,1773008991.181341887,'{"timestamp": "2026-03-08T23:29:51.181342+0100", "flow_id": 1209186976401195, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 53540, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 4, "pkts_toclient": 0, "bytes_toserver": 240, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.084927+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 53540, "dest_port": 5432}}');
INSERT INTO alerts VALUES(1060,1773008991.304955005,'{"timestamp": "2026-03-08T23:29:51.304955+0100", "flow_id": 1177140330716117, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 52578, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 4, "pkts_toclient": 0, "bytes_toserver": 240, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.208538+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 52578, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1061,1773008991.49834299,'{"timestamp": "2026-03-08T23:29:51.498343+0100", "flow_id": 1390864605715648, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 59792, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 4, "pkts_toclient": 0, "bytes_toserver": 240, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.389371+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 59792, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1062,1773008991.687694073,'{"timestamp": "2026-03-08T23:29:51.687694+0100", "flow_id": 1206856937159214, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 47090, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 4, "pkts_toclient": 0, "bytes_toserver": 240, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.608673+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 47090, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1063,1773008992.20309496,'{"timestamp": "2026-03-08T23:29:52.203095+0100", "flow_id": 1209186976401195, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 53540, "dest_ip": "185.254.126.122", "dest_port": 5432, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010939, "rev": 3, "signature": "ET SCAN Suspicious inbound to PostgreSQL port 5432", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 5, "pkts_toclient": 0, "bytes_toserver": 300, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.084927+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 53540, "dest_port": 5432}}');
INSERT INTO alerts VALUES(1064,1773008992.326447963,'{"timestamp": "2026-03-08T23:29:52.326448+0100", "flow_id": 1177140330716117, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 52578, "dest_ip": "185.254.126.122", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 5, "pkts_toclient": 0, "bytes_toserver": 300, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.208538+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 52578, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1065,1773008992.51782608,'{"timestamp": "2026-03-08T23:29:52.517826+0100", "flow_id": 1390864605715648, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 59792, "dest_ip": "185.254.126.122", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 5, "pkts_toclient": 0, "bytes_toserver": 300, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.389371+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 59792, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1066,1773008992.586827994,'{"timestamp": "2026-03-08T23:29:52.586828+0100", "flow_id": 1286960044297037, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 37812, "dest_ip": "185.254.126.122", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2001219, "rev": 20, "signature": "ET SCAN Potential SSH Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 5, "pkts_toclient": 0, "bytes_toserver": 300, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.496251+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 37812, "dest_port": 22}}');
INSERT INTO alerts VALUES(1067,1773008992.712091922,'{"timestamp": "2026-03-08T23:29:52.712092+0100", "flow_id": 1206856937159214, "event_type": "alert", "src_ip": "18.219.193.156", "src_port": 47090, "dest_ip": "185.254.126.122", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 5, "pkts_toclient": 0, "bytes_toserver": 300, "bytes_toclient": 0, "start": "2026-03-08T23:29:48.608673+0100", "src_ip": "18.219.193.156", "dest_ip": "185.254.126.122", "src_port": 47090, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1068,1773009010.874358892,'{"timestamp": "2026-03-08T23:30:10.874359+0100", "flow_id": 659119446273088, "event_type": "alert", "src_ip": "167.94.146.36", "src_port": 24610, "dest_ip": "185.254.126.122", "dest_port": 6031, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-08T23:30:10.874359+0100", "src_ip": "167.94.146.36", "dest_ip": "185.254.126.122", "src_port": 24610, "dest_port": 6031}}');
INSERT INTO alerts VALUES(1069,1773009015.935105085,'{"timestamp": "2026-03-08T23:30:15.935105+0100", "flow_id": 2045923514154971, "event_type": "alert", "src_ip": "172.94.9.253", "src_port": 48507, "dest_ip": "185.254.126.122", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400031, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 32", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-08T23:30:15.935105+0100", "src_ip": "172.94.9.253", "dest_ip": "185.254.126.122", "src_port": 48507, "dest_port": 80}}');
INSERT INTO alerts VALUES(1070,1773036222.630697011,'{"timestamp": "2026-03-09T07:03:42.630697+0100", "flow_id": 1864399548359244, "event_type": "alert", "src_ip": "91.196.152.76", "src_port": 46195, "dest_ip": "134.19.55.199", "dest_port": 20201, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:03:42.630697+0100", "src_ip": "91.196.152.76", "dest_ip": "134.19.55.199", "src_port": 46195, "dest_port": 20201}}');
INSERT INTO alerts VALUES(1071,1773036223.388921023,'{"timestamp": "2026-03-09T07:03:43.388921+0100", "flow_id": 2233356069924742, "event_type": "alert", "src_ip": "71.6.232.27", "src_port": 56585, "dest_ip": "134.19.55.199", "dest_port": 161, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2101411, "rev": 13, "signature": "GPL SNMP public access udp", "category": "Attempted Information Leak", "severity": 2, "metadata": {"created_at": ["2010_09_23"], "cve": ["CVE_1999_0517"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2019_10_08"]}}, "app_proto": "snmp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 71, "bytes_toclient": 0, "start": "2026-03-09T07:03:43.388921+0100", "src_ip": "71.6.232.27", "dest_ip": "134.19.55.199", "src_port": 56585, "dest_port": 161}}');
INSERT INTO alerts VALUES(1072,1773036307.346844912,'{"timestamp": "2026-03-09T07:05:07.346845+0100", "flow_id": 926739967536712, "event_type": "alert", "src_ip": "167.94.138.148", "src_port": 58955, "dest_ip": "134.19.55.199", "dest_port": 5632, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 30, "bytes_toclient": 0, "start": "2026-03-09T07:05:07.346845+0100", "src_ip": "167.94.138.148", "dest_ip": "134.19.55.199", "src_port": 58955, "dest_port": 5632}}');
INSERT INTO alerts VALUES(1073,1773036334.179909944,'{"timestamp": "2026-03-09T07:05:34.179910+0100", "flow_id": 1898609246114519, "event_type": "alert", "src_ip": "64.62.156.50", "src_port": 45630, "dest_ip": "134.19.55.199", "dest_port": 135, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:05:34.179910+0100", "src_ip": "64.62.156.50", "dest_ip": "134.19.55.199", "src_port": 45630, "dest_port": 135}}');
INSERT INTO alerts VALUES(1074,1773036361.536153079,'{"timestamp": "2026-03-09T07:06:01.536153+0100", "flow_id": 332434959313741, "event_type": "alert", "src_ip": "110.164.64.243", "src_port": 49721, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:06:01.536153+0100", "src_ip": "110.164.64.243", "dest_ip": "134.19.55.199", "src_port": 49721, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1075,1773036417.043167115,'{"timestamp": "2026-03-09T07:06:57.043167+0100", "flow_id": 466878087777628, "event_type": "alert", "src_ip": "46.151.182.187", "src_port": 56303, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:06:57.043167+0100", "src_ip": "46.151.182.187", "dest_ip": "134.19.55.199", "src_port": 56303, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1076,1773036417.043167115,'{"timestamp": "2026-03-09T07:06:57.043167+0100", "flow_id": 466878087777628, "event_type": "alert", "src_ip": "46.151.182.187", "src_port": 56303, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:06:57.043167+0100", "src_ip": "46.151.182.187", "dest_ip": "134.19.55.199", "src_port": 56303, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1077,1773036426.656002045,'{"timestamp": "2026-03-09T07:07:06.656002+0100", "flow_id": 565711099458443, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 55735, "dest_ip": "134.19.55.199", "dest_port": 24307, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:07:06.656002+0100", "src_ip": "79.124.62.134", "dest_ip": "134.19.55.199", "src_port": 55735, "dest_port": 24307}}');
INSERT INTO alerts VALUES(1078,1773036433.240202904,'{"timestamp": "2026-03-09T07:07:13.240203+0100", "flow_id": 468715134312210, "event_type": "alert", "src_ip": "147.185.132.132", "src_port": 54197, "dest_ip": "134.19.55.199", "dest_port": 4025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:07:13.240203+0100", "src_ip": "147.185.132.132", "dest_ip": "134.19.55.199", "src_port": 54197, "dest_port": 4025}}');
INSERT INTO alerts VALUES(1079,1773036444.523850918,'{"timestamp": "2026-03-09T07:07:24.523851+0100", "flow_id": 1405498147213937, "event_type": "alert", "src_ip": "193.163.125.189", "src_port": 40966, "dest_ip": "134.19.55.199", "dest_port": 8071, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:07:24.523851+0100", "src_ip": "193.163.125.189", "dest_ip": "134.19.55.199", "src_port": 40966, "dest_port": 8071}}');
INSERT INTO alerts VALUES(1080,1773036487.675314904,'{"timestamp": "2026-03-09T07:08:07.675315+0100", "flow_id": 2056032378815202, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "134.19.55.199", "dest_port": 26733, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:08:07.675315+0100", "src_ip": "130.12.180.88", "dest_ip": "134.19.55.199", "src_port": 52302, "dest_port": 26733}}');
INSERT INTO alerts VALUES(1081,1773036487.675314904,'{"timestamp": "2026-03-09T07:08:07.675315+0100", "flow_id": 2056032378815202, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "134.19.55.199", "dest_port": 26733, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:08:07.675315+0100", "src_ip": "130.12.180.88", "dest_ip": "134.19.55.199", "src_port": 52302, "dest_port": 26733}}');
INSERT INTO alerts VALUES(1082,1773036539.145500899,'{"timestamp": "2026-03-09T07:08:59.145501+0100", "flow_id": 906401068050482, "event_type": "alert", "src_ip": "64.62.156.121", "src_port": 48701, "dest_ip": "134.19.55.199", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:08:59.145501+0100", "src_ip": "64.62.156.121", "dest_ip": "134.19.55.199", "src_port": 48701, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1083,1773036539.145500899,'{"timestamp": "2026-03-09T07:08:59.145501+0100", "flow_id": 906401068050482, "event_type": "alert", "src_ip": "64.62.156.121", "src_port": 48701, "dest_ip": "134.19.55.199", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:08:59.145501+0100", "src_ip": "64.62.156.121", "dest_ip": "134.19.55.199", "src_port": 48701, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1084,1773036558.602718115,'{"timestamp": "2026-03-09T07:09:18.602718+0100", "flow_id": 1744231798195582, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 35443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:09:18.602718+0100", "src_ip": "185.156.73.86", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 35443}}');
INSERT INTO alerts VALUES(1085,1773036571.692570924,'{"timestamp": "2026-03-09T07:09:31.692571+0100", "flow_id": 1004246884715008, "event_type": "alert", "src_ip": "79.124.62.178", "src_port": 54267, "dest_ip": "134.19.55.199", "dest_port": 3390, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:09:31.692571+0100", "src_ip": "79.124.62.178", "dest_ip": "134.19.55.199", "src_port": 54267, "dest_port": 3390}}');
INSERT INTO alerts VALUES(1086,1773036572.85676694,'{"timestamp": "2026-03-09T07:09:32.856767+0100", "flow_id": 1146512866055788, "event_type": "alert", "src_ip": "195.184.76.69", "src_port": 21085, "dest_ip": "134.19.55.199", "dest_port": 5554, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:09:32.856767+0100", "src_ip": "195.184.76.69", "dest_ip": "134.19.55.199", "src_port": 21085, "dest_port": 5554}}');
INSERT INTO alerts VALUES(1087,1773036642.015852929,'{"timestamp": "2026-03-09T07:10:42.015853+0100", "flow_id": 631039851771365, "event_type": "alert", "src_ip": "64.62.197.142", "src_port": 45464, "dest_ip": "134.19.55.199", "dest_port": 8030, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:10:42.015853+0100", "src_ip": "64.62.197.142", "dest_ip": "134.19.55.199", "src_port": 45464, "dest_port": 8030}}');
INSERT INTO alerts VALUES(1088,1773036654.165035009,'{"timestamp": "2026-03-09T07:10:54.165035+0100", "flow_id": 1834722376447144, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 55075, "dest_ip": "134.19.55.199", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:10:54.165035+0100", "src_ip": "79.124.62.126", "dest_ip": "134.19.55.199", "src_port": 55075, "dest_port": 3389}}');
INSERT INTO alerts VALUES(1089,1773036655.518362998,'{"timestamp": "2026-03-09T07:10:55.518363+0100", "flow_id": 2226355668886042, "event_type": "alert", "src_ip": "198.143.149.250", "src_port": 8293, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2008578, "rev": 4, "signature": "ET SCAN Sipvicious Scan", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 432, "bytes_toclient": 0, "start": "2026-03-09T07:10:55.518363+0100", "src_ip": "198.143.149.250", "dest_ip": "134.19.55.199", "src_port": 8293, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1090,1773036655.518362998,'{"timestamp": "2026-03-09T07:10:55.518363+0100", "flow_id": 2226355668886042, "event_type": "alert", "src_ip": "198.143.149.250", "src_port": 8293, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "sip", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 432, "bytes_toclient": 0, "start": "2026-03-09T07:10:55.518363+0100", "src_ip": "198.143.149.250", "dest_ip": "134.19.55.199", "src_port": 8293, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1091,1773036678.6809659,'{"timestamp": "2026-03-09T07:11:18.680966+0100", "flow_id": 1798829051173826, "event_type": "alert", "src_ip": "176.65.139.12", "src_port": 33891, "dest_ip": "134.19.55.199", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:11:18.680966+0100", "src_ip": "176.65.139.12", "dest_ip": "134.19.55.199", "src_port": 33891, "dest_port": 17000}}');
INSERT INTO alerts VALUES(1092,1773036701.282941103,'{"timestamp": "2026-03-09T07:11:41.282941+0100", "flow_id": 1496699402049241, "event_type": "alert", "src_ip": "205.210.31.242", "src_port": 52572, "dest_ip": "134.19.55.199", "dest_port": 49501, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:11:41.282941+0100", "src_ip": "205.210.31.242", "dest_ip": "134.19.55.199", "src_port": 52572, "dest_port": 49501}}');
INSERT INTO alerts VALUES(1093,1773036710.173868894,'{"timestamp": "2026-03-09T07:11:50.173869+0100", "flow_id": 1872664483370769, "event_type": "alert", "src_ip": "198.235.24.164", "src_port": 51303, "dest_ip": "134.19.55.199", "dest_port": 11553, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:11:50.173869+0100", "src_ip": "198.235.24.164", "dest_ip": "134.19.55.199", "src_port": 51303, "dest_port": 11553}}');
INSERT INTO alerts VALUES(1094,1773036768.521800994,'{"timestamp": "2026-03-09T07:12:48.521801+0100", "flow_id": 270796948941255, "event_type": "alert", "src_ip": "205.210.31.78", "src_port": 55032, "dest_ip": "134.19.55.199", "dest_port": 88, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:12:48.521801+0100", "src_ip": "205.210.31.78", "dest_ip": "134.19.55.199", "src_port": 55032, "dest_port": 88}}');
INSERT INTO alerts VALUES(1095,1773036775.513375043,'{"timestamp": "2026-03-09T07:12:55.513375+0100", "flow_id": 2204932821066979, "event_type": "alert", "src_ip": "193.163.125.208", "src_port": 34506, "dest_ip": "134.19.55.199", "dest_port": 1801, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:12:55.513375+0100", "src_ip": "193.163.125.208", "dest_ip": "134.19.55.199", "src_port": 34506, "dest_port": 1801}}');
INSERT INTO alerts VALUES(1096,1773036806.581167936,'{"timestamp": "2026-03-09T07:13:26.581168+0100", "flow_id": 1933150958757855, "event_type": "alert", "src_ip": "88.210.63.193", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 34436, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:13:26.581168+0100", "src_ip": "88.210.63.193", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 34436}}');
INSERT INTO alerts VALUES(1097,1773036817.976715087,'{"timestamp": "2026-03-09T07:13:37.976715+0100", "flow_id": 535785201820391, "event_type": "alert", "src_ip": "147.185.132.45", "src_port": 49189, "dest_ip": "134.19.55.199", "dest_port": 20257, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:13:37.976715+0100", "src_ip": "147.185.132.45", "dest_ip": "134.19.55.199", "src_port": 49189, "dest_port": 20257}}');
INSERT INTO alerts VALUES(1098,1773036831.507014037,'{"timestamp": "2026-03-09T07:13:51.507014+0100", "flow_id": 2177609840320995, "event_type": "alert", "src_ip": "91.196.152.221", "src_port": 11730, "dest_ip": "134.19.55.199", "dest_port": 2001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:13:51.507014+0100", "src_ip": "91.196.152.221", "dest_ip": "134.19.55.199", "src_port": 11730, "dest_port": 2001}}');
INSERT INTO alerts VALUES(1099,1773036835.931251049,'{"timestamp": "2026-03-09T07:13:55.931251+0100", "flow_id": 903468456789260, "event_type": "alert", "src_ip": "65.49.1.235", "src_port": 49657, "dest_ip": "134.19.55.199", "dest_port": 4080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:13:55.931251+0100", "src_ip": "65.49.1.235", "dest_ip": "134.19.55.199", "src_port": 49657, "dest_port": 4080}}');
INSERT INTO alerts VALUES(1100,1773036836.377820968,'{"timestamp": "2026-03-09T07:13:56.377821+0100", "flow_id": 1341257660350416, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "134.19.55.199", "dest_port": 2443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:13:56.377821+0100", "src_ip": "204.76.203.215", "dest_ip": "134.19.55.199", "src_port": 40000, "dest_port": 2443}}');
INSERT INTO alerts VALUES(1101,1773036836.377820968,'{"timestamp": "2026-03-09T07:13:56.377821+0100", "flow_id": 1341257660350416, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "134.19.55.199", "dest_port": 2443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:13:56.377821+0100", "src_ip": "204.76.203.215", "dest_ip": "134.19.55.199", "src_port": 40000, "dest_port": 2443}}');
INSERT INTO alerts VALUES(1102,1773036840.432856082,'{"timestamp": "2026-03-09T07:14:00.432856+0100", "flow_id": 170253426849800, "event_type": "alert", "src_ip": "193.163.125.188", "src_port": 52542, "dest_ip": "134.19.55.199", "dest_port": 639, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:14:00.432856+0100", "src_ip": "193.163.125.188", "dest_ip": "134.19.55.199", "src_port": 52542, "dest_port": 639}}');
INSERT INTO alerts VALUES(1103,1773036846.405678034,'{"timestamp": "2026-03-09T07:14:06.405678+0100", "flow_id": 1742377302742764, "event_type": "alert", "src_ip": "91.196.152.179", "src_port": 63260, "dest_ip": "134.19.55.199", "dest_port": 17185, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:14:06.405678+0100", "src_ip": "91.196.152.179", "dest_ip": "134.19.55.199", "src_port": 63260, "dest_port": 17185}}');
INSERT INTO alerts VALUES(1104,1773036852.510215997,'{"timestamp": "2026-03-09T07:14:12.510216+0100", "flow_id": 1346939275379302, "event_type": "alert", "src_ip": "176.65.149.235", "src_port": 56989, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:14:12.510216+0100", "src_ip": "176.65.149.235", "dest_ip": "134.19.55.199", "src_port": 56989, "dest_port": 80}}');
INSERT INTO alerts VALUES(1105,1773036865.728931903,'{"timestamp": "2026-03-09T07:14:25.728932+0100", "flow_id": 315992069815886, "event_type": "alert", "src_ip": "167.94.146.46", "src_port": 55122, "dest_ip": "134.19.55.199", "dest_port": 22088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:14:25.728932+0100", "src_ip": "167.94.146.46", "dest_ip": "134.19.55.199", "src_port": 55122, "dest_port": 22088}}');
INSERT INTO alerts VALUES(1106,1773036934.831127882,'{"timestamp": "2026-03-09T07:15:34.831128+0100", "flow_id": 1880818602500973, "event_type": "alert", "src_ip": "64.62.197.44", "src_port": 53079, "dest_ip": "134.19.55.199", "dest_port": 4081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:15:34.831128+0100", "src_ip": "64.62.197.44", "dest_ip": "134.19.55.199", "src_port": 53079, "dest_port": 4081}}');
INSERT INTO alerts VALUES(1107,1773036971.879071951,'{"timestamp": "2026-03-09T07:16:11.879072+0100", "flow_id": 960836732469142, "event_type": "alert", "src_ip": "64.62.156.171", "src_port": 58115, "dest_ip": "134.19.55.199", "dest_port": 4433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:16:11.879072+0100", "src_ip": "64.62.156.171", "dest_ip": "134.19.55.199", "src_port": 58115, "dest_port": 4433}}');
INSERT INTO alerts VALUES(1108,1773037072.143234969,'{"timestamp": "2026-03-09T07:17:52.143235+0100", "flow_id": 52242569581887, "event_type": "alert", "src_ip": "205.210.31.109", "src_port": 51213, "dest_ip": "134.19.55.199", "dest_port": 5050, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:17:52.143235+0100", "src_ip": "205.210.31.109", "dest_ip": "134.19.55.199", "src_port": 51213, "dest_port": 5050}}');
INSERT INTO alerts VALUES(1109,1773037105.048199893,'{"timestamp": "2026-03-09T07:18:25.048200+0100", "flow_id": 488496338814767, "event_type": "alert", "src_ip": "198.235.24.192", "src_port": 54611, "dest_ip": "134.19.55.199", "dest_port": 20123, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:18:25.048200+0100", "src_ip": "198.235.24.192", "dest_ip": "134.19.55.199", "src_port": 54611, "dest_port": 20123}}');
INSERT INTO alerts VALUES(1110,1773037128.305166959,'{"timestamp": "2026-03-09T07:18:48.305167+0100", "flow_id": 184783163142464, "event_type": "alert", "src_ip": "147.185.132.189", "src_port": 57054, "dest_ip": "134.19.55.199", "dest_port": 5938, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:18:48.305167+0100", "src_ip": "147.185.132.189", "dest_ip": "134.19.55.199", "src_port": 57054, "dest_port": 5938}}');
INSERT INTO alerts VALUES(1111,1773037191.911829949,'{"timestamp": "2026-03-09T07:19:51.911830+0100", "flow_id": 2227434056404440, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 54370, "dest_ip": "134.19.55.199", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T07:19:51.911830+0100", "src_ip": "204.76.203.56", "dest_ip": "134.19.55.199", "src_port": 54370, "dest_port": 8332}}');
INSERT INTO alerts VALUES(1112,1773037191.911829949,'{"timestamp": "2026-03-09T07:19:51.911830+0100", "flow_id": 2227434056404440, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 54370, "dest_ip": "134.19.55.199", "dest_port": 8332, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T07:19:51.911830+0100", "src_ip": "204.76.203.56", "dest_ip": "134.19.55.199", "src_port": 54370, "dest_port": 8332}}');
INSERT INTO alerts VALUES(1113,1773037210.874326945,'{"timestamp": "2026-03-09T07:20:10.874327+0100", "flow_id": 658982090918552, "event_type": "alert", "src_ip": "193.163.125.182", "src_port": 46123, "dest_ip": "134.19.55.199", "dest_port": 862, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:20:10.874327+0100", "src_ip": "193.163.125.182", "dest_ip": "134.19.55.199", "src_port": 46123, "dest_port": 862}}');
INSERT INTO alerts VALUES(1114,1773037215.023777009,'{"timestamp": "2026-03-09T07:20:15.023777+0100", "flow_id": 2072450339309093, "event_type": "alert", "src_ip": "198.235.24.166", "src_port": 52979, "dest_ip": "134.19.55.199", "dest_port": 2085, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:20:15.023777+0100", "src_ip": "198.235.24.166", "dest_ip": "134.19.55.199", "src_port": 52979, "dest_port": 2085}}');
INSERT INTO alerts VALUES(1115,1773037224.330451966,'{"timestamp": "2026-03-09T07:20:24.330452+0100", "flow_id": 11908871786235, "event_type": "alert", "src_ip": "65.49.1.148", "src_port": 41655, "dest_ip": "134.19.55.199", "dest_port": 9100, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:20:24.330452+0100", "src_ip": "65.49.1.148", "dest_ip": "134.19.55.199", "src_port": 41655, "dest_port": 9100}}');
INSERT INTO alerts VALUES(1116,1773037228.503587008,'{"timestamp": "2026-03-09T07:20:28.503587+0100", "flow_id": 1318467846362255, "event_type": "alert", "src_ip": "185.242.226.33", "src_port": 46748, "dest_ip": "134.19.55.199", "dest_port": 993, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:20:28.503587+0100", "src_ip": "185.242.226.33", "dest_ip": "134.19.55.199", "src_port": 46748, "dest_port": 993}}');
INSERT INTO alerts VALUES(1117,1773037229.412448883,'{"timestamp": "2026-03-09T07:20:29.412449+0100", "flow_id": 1489983416852095, "event_type": "alert", "src_ip": "195.184.76.135", "src_port": 13493, "dest_ip": "134.19.55.199", "dest_port": 6391, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:20:29.412449+0100", "src_ip": "195.184.76.135", "dest_ip": "134.19.55.199", "src_port": 13493, "dest_port": 6391}}');
INSERT INTO alerts VALUES(1118,1773037280.758011103,'{"timestamp": "2026-03-09T07:21:20.758011+0100", "flow_id": 159411743153044, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 9443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:21:20.758011+0100", "src_ip": "88.210.63.69", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 9443}}');
INSERT INTO alerts VALUES(1119,1773037389.756347895,'{"timestamp": "2026-03-09T07:23:09.756348+0100", "flow_id": 1559644351378612, "event_type": "alert", "src_ip": "176.65.149.215", "src_port": 55797, "dest_ip": "134.19.55.199", "dest_port": 999, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:23:09.756348+0100", "src_ip": "176.65.149.215", "dest_ip": "134.19.55.199", "src_port": 55797, "dest_port": 999}}');
INSERT INTO alerts VALUES(1120,1773037426.401751041,'{"timestamp": "2026-03-09T07:23:46.401751+0100", "flow_id": 599609555371684, "event_type": "alert", "src_ip": "64.62.197.42", "src_port": 50996, "dest_ip": "134.19.55.199", "dest_port": 12443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:23:46.401751+0100", "src_ip": "64.62.197.42", "dest_ip": "134.19.55.199", "src_port": 50996, "dest_port": 12443}}');
INSERT INTO alerts VALUES(1121,1773037497.125540019,'{"timestamp": "2026-03-09T07:24:57.125540+0100", "flow_id": 539193010418688, "event_type": "alert", "src_ip": "167.94.146.74", "src_port": 32516, "dest_ip": "134.19.55.199", "dest_port": 1312, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:24:57.125540+0100", "src_ip": "167.94.146.74", "dest_ip": "134.19.55.199", "src_port": 32516, "dest_port": 1312}}');
INSERT INTO alerts VALUES(1122,1773037508.849476099,'{"timestamp": "2026-03-09T07:25:08.849476+0100", "flow_id": 1396672499514606, "event_type": "alert", "src_ip": "193.142.146.230", "src_port": 32875, "dest_ip": "134.19.55.199", "dest_port": 8090, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400039, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 40", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:25:08.849476+0100", "src_ip": "193.142.146.230", "dest_ip": "134.19.55.199", "src_port": 32875, "dest_port": 8090}}');
INSERT INTO alerts VALUES(1123,1773037568.381007909,'{"timestamp": "2026-03-09T07:26:08.381008+0100", "flow_id": 229043547912942, "event_type": "alert", "src_ip": "147.185.132.111", "src_port": 52731, "dest_ip": "134.19.55.199", "dest_port": 53631, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:26:08.381008+0100", "src_ip": "147.185.132.111", "dest_ip": "134.19.55.199", "src_port": 52731, "dest_port": 53631}}');
INSERT INTO alerts VALUES(1124,1773037593.754159927,'{"timestamp": "2026-03-09T07:26:33.754160+0100", "flow_id": 424343609985226, "event_type": "alert", "src_ip": "45.153.34.187", "src_port": 51418, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:26:33.754160+0100", "src_ip": "45.153.34.187", "dest_ip": "134.19.55.199", "src_port": 51418, "dest_port": 80}}');
INSERT INTO alerts VALUES(1125,1773037599.657485962,'{"timestamp": "2026-03-09T07:26:39.657486+0100", "flow_id": 1979457046482774, "event_type": "alert", "src_ip": "193.163.125.200", "src_port": 52479, "dest_ip": "134.19.55.199", "dest_port": 40443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:26:39.657486+0100", "src_ip": "193.163.125.200", "dest_ip": "134.19.55.199", "src_port": 52479, "dest_port": 40443}}');
INSERT INTO alerts VALUES(1126,1773037623.105071068,'{"timestamp": "2026-03-09T07:27:03.105071+0100", "flow_id": 2140128547663460, "event_type": "alert", "src_ip": "185.242.226.11", "src_port": 45608, "dest_ip": "134.19.55.199", "dest_port": 12273, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:27:03.105071+0100", "src_ip": "185.242.226.11", "dest_ip": "134.19.55.199", "src_port": 45608, "dest_port": 12273}}');
INSERT INTO alerts VALUES(1127,1773037636.306423902,'{"timestamp": "2026-03-09T07:27:16.306424+0100", "flow_id": 1316081515628142, "event_type": "alert", "src_ip": "64.62.197.13", "src_port": 55029, "dest_ip": "134.19.55.199", "dest_port": 65422, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:27:16.306424+0100", "src_ip": "64.62.197.13", "dest_ip": "134.19.55.199", "src_port": 55029, "dest_port": 65422}}');
INSERT INTO alerts VALUES(1128,1773037662.900444984,'{"timestamp": "2026-03-09T07:27:42.900445+0100", "flow_id": 1897058757220439, "event_type": "alert", "src_ip": "147.185.132.198", "src_port": 51757, "dest_ip": "134.19.55.199", "dest_port": 12345, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:27:42.900445+0100", "src_ip": "147.185.132.198", "dest_ip": "134.19.55.199", "src_port": 51757, "dest_port": 12345}}');
INSERT INTO alerts VALUES(1129,1773037663.125292062,'{"timestamp": "2026-03-09T07:27:43.125292+0100", "flow_id": 2226977984043981, "event_type": "alert", "src_ip": "64.62.156.40", "src_port": 17534, "dest_ip": "134.19.55.199", "dest_port": 111, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 68, "bytes_toclient": 0, "start": "2026-03-09T07:27:43.125292+0100", "src_ip": "64.62.156.40", "dest_ip": "134.19.55.199", "src_port": 17534, "dest_port": 111}}');
INSERT INTO alerts VALUES(1130,1773037692.580343962,'{"timestamp": "2026-03-09T07:28:12.580344+0100", "flow_id": 1366662357601750, "event_type": "alert", "src_ip": "167.94.138.126", "src_port": 37782, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:28:12.580344+0100", "src_ip": "167.94.138.126", "dest_ip": "134.19.55.199", "src_port": 37782, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1131,1773037755.422679901,'{"timestamp": "2026-03-09T07:29:15.422680+0100", "flow_id": 970973916652120, "event_type": "alert", "src_ip": "65.49.1.173", "src_port": 45288, "dest_ip": "134.19.55.199", "dest_port": 403, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:29:15.422680+0100", "src_ip": "65.49.1.173", "dest_ip": "134.19.55.199", "src_port": 45288, "dest_port": 403}}');
INSERT INTO alerts VALUES(1132,1773037784.274667024,'{"timestamp": "2026-03-09T07:29:44.274667+0100", "flow_id": 53787155878268, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 55735, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:29:44.274667+0100", "src_ip": "79.124.62.134", "dest_ip": "134.19.55.199", "src_port": 55735, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1133,1773037857.600313901,'{"timestamp": "2026-03-09T07:30:57.600314+0100", "flow_id": 326529509398779, "event_type": "alert", "src_ip": "167.94.138.152", "src_port": 45404, "dest_ip": "134.19.55.199", "dest_port": 9599, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:30:57.600314+0100", "src_ip": "167.94.138.152", "dest_ip": "134.19.55.199", "src_port": 45404, "dest_port": 9599}}');
INSERT INTO alerts VALUES(1134,1773037884.322928905,'{"timestamp": "2026-03-09T07:31:24.322929+0100", "flow_id": 1386972079626544, "event_type": "alert", "src_ip": "198.235.24.126", "src_port": 55051, "dest_ip": "134.19.55.199", "dest_port": 50070, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:31:24.322929+0100", "src_ip": "198.235.24.126", "dest_ip": "134.19.55.199", "src_port": 55051, "dest_port": 50070}}');
INSERT INTO alerts VALUES(1135,1773037895.872467041,'{"timestamp": "2026-03-09T07:31:35.872467+0100", "flow_id": 2058371373641532, "event_type": "alert", "src_ip": "64.62.197.148", "src_port": 35593, "dest_ip": "134.19.55.199", "dest_port": 17689, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:31:35.872467+0100", "src_ip": "64.62.197.148", "dest_ip": "134.19.55.199", "src_port": 35593, "dest_port": 17689}}');
INSERT INTO alerts VALUES(1136,1773037904.635621071,'{"timestamp": "2026-03-09T07:31:44.635621+0100", "flow_id": 196698608526861, "event_type": "alert", "src_ip": "64.62.156.170", "src_port": 39290, "dest_ip": "134.19.55.199", "dest_port": 7000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:31:44.635621+0100", "src_ip": "64.62.156.170", "dest_ip": "134.19.55.199", "src_port": 39290, "dest_port": 7000}}');
INSERT INTO alerts VALUES(1137,1773037916.86955309,'{"timestamp": "2026-03-09T07:31:56.869553+0100", "flow_id": 1201431114793723, "event_type": "alert", "src_ip": "198.235.24.97", "src_port": 55296, "dest_ip": "134.19.55.199", "dest_port": 30006, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:31:56.869553+0100", "src_ip": "198.235.24.97", "dest_ip": "134.19.55.199", "src_port": 55296, "dest_port": 30006}}');
INSERT INTO alerts VALUES(1138,1773037935.792548894,'{"timestamp": "2026-03-09T07:32:15.792549+0100", "flow_id": 1996600988449712, "event_type": "alert", "src_ip": "195.184.76.39", "src_port": 9532, "dest_ip": "134.19.55.199", "dest_port": 5706, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:32:15.792549+0100", "src_ip": "195.184.76.39", "dest_ip": "134.19.55.199", "src_port": 9532, "dest_port": 5706}}');
INSERT INTO alerts VALUES(1139,1773037978.217227936,'{"timestamp": "2026-03-09T07:32:58.217228+0100", "flow_id": 651512312469309, "event_type": "alert", "src_ip": "147.185.132.246", "src_port": 51865, "dest_ip": "134.19.55.199", "dest_port": 8880, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:32:58.217228+0100", "src_ip": "147.185.132.246", "dest_ip": "134.19.55.199", "src_port": 51865, "dest_port": 8880}}');
INSERT INTO alerts VALUES(1140,1773037991.198327064,'{"timestamp": "2026-03-09T07:33:11.198327+0100", "flow_id": 1977709732866325, "event_type": "alert", "src_ip": "195.184.76.181", "src_port": 62029, "dest_ip": "134.19.55.199", "dest_port": 5112, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:33:11.198327+0100", "src_ip": "195.184.76.181", "dest_ip": "134.19.55.199", "src_port": 62029, "dest_port": 5112}}');
INSERT INTO alerts VALUES(1141,1773038024.402508975,'{"timestamp": "2026-03-09T07:33:44.402509+0100", "flow_id": 39914968032187, "event_type": "alert", "src_ip": "167.94.138.136", "src_port": 22304, "dest_ip": "134.19.55.199", "dest_port": 2222, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:33:44.402509+0100", "src_ip": "167.94.138.136", "dest_ip": "134.19.55.199", "src_port": 22304, "dest_port": 2222}}');
INSERT INTO alerts VALUES(1142,1773038039.796852112,'{"timestamp": "2026-03-09T07:33:59.796852+0100", "flow_id": 2015079669174452, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 45049, "dest_ip": "134.19.55.199", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:33:59.796852+0100", "src_ip": "130.12.180.174", "dest_ip": "134.19.55.199", "src_port": 45049, "dest_port": 23}}');
INSERT INTO alerts VALUES(1143,1773038039.796852112,'{"timestamp": "2026-03-09T07:33:59.796852+0100", "flow_id": 2015079669174452, "event_type": "alert", "src_ip": "130.12.180.174", "src_port": 45049, "dest_ip": "134.19.55.199", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:33:59.796852+0100", "src_ip": "130.12.180.174", "dest_ip": "134.19.55.199", "src_port": 45049, "dest_port": 23}}');
INSERT INTO alerts VALUES(1144,1773038057.141865015,'{"timestamp": "2026-03-09T07:34:17.141865+0100", "flow_id": 327834395826841, "event_type": "alert", "src_ip": "193.163.125.205", "src_port": 56883, "dest_ip": "134.19.55.199", "dest_port": 30005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:34:17.141865+0100", "src_ip": "193.163.125.205", "dest_ip": "134.19.55.199", "src_port": 56883, "dest_port": 30005}}');
INSERT INTO alerts VALUES(1145,1773038064.290029049,'{"timestamp": "2026-03-09T07:34:24.290029+0100", "flow_id": 119768838292622, "event_type": "alert", "src_ip": "167.94.146.40", "src_port": 5297, "dest_ip": "134.19.55.199", "dest_port": 40972, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:34:24.290029+0100", "src_ip": "167.94.146.40", "dest_ip": "134.19.55.199", "src_port": 5297, "dest_port": 40972}}');
INSERT INTO alerts VALUES(1146,1773038082.114542961,'{"timestamp": "2026-03-09T07:34:42.114543+0100", "flow_id": 773437490663846, "event_type": "alert", "src_ip": "167.94.138.96", "src_port": 18984, "dest_ip": "134.19.55.199", "dest_port": 27310, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:34:42.114543+0100", "src_ip": "167.94.138.96", "dest_ip": "134.19.55.199", "src_port": 18984, "dest_port": 27310}}');
INSERT INTO alerts VALUES(1147,1773038114.509227992,'{"timestamp": "2026-03-09T07:35:14.509228+0100", "flow_id": 779743842334744, "event_type": "alert", "src_ip": "193.163.125.213", "src_port": 44232, "dest_ip": "134.19.55.199", "dest_port": 11554, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:35:14.509228+0100", "src_ip": "193.163.125.213", "dest_ip": "134.19.55.199", "src_port": 44232, "dest_port": 11554}}');
INSERT INTO alerts VALUES(1148,1773038120.544270993,'{"timestamp": "2026-03-09T07:35:20.544271+0100", "flow_id": 85826790145206, "event_type": "alert", "src_ip": "66.132.153.153", "src_port": 49756, "dest_ip": "134.19.55.199", "dest_port": 1967, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-09T07:35:20.544271+0100", "src_ip": "66.132.153.153", "dest_ip": "134.19.55.199", "src_port": 49756, "dest_port": 1967}}');
INSERT INTO alerts VALUES(1149,1773038145.496366978,'{"timestamp": "2026-03-09T07:35:45.496367+0100", "flow_id": 443032098081166, "event_type": "alert", "src_ip": "176.65.149.233", "src_port": 36200, "dest_ip": "134.19.55.199", "dest_port": 8088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:35:45.496367+0100", "src_ip": "176.65.149.233", "dest_ip": "134.19.55.199", "src_port": 36200, "dest_port": 8088}}');
INSERT INTO alerts VALUES(1150,1773038189.212532997,'{"timestamp": "2026-03-09T07:36:29.212533+0100", "flow_id": 1475773874859911, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 57633, "dest_ip": "134.19.55.199", "dest_port": 45102, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:36:29.212533+0100", "src_ip": "79.124.62.230", "dest_ip": "134.19.55.199", "src_port": 57633, "dest_port": 45102}}');
INSERT INTO alerts VALUES(1151,1773038209.1593709,'{"timestamp": "2026-03-09T07:36:49.159371+0100", "flow_id": 403021398703205, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 29752, "dest_ip": "134.19.55.199", "dest_port": 2726, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:36:49.159371+0100", "src_ip": "167.94.146.37", "dest_ip": "134.19.55.199", "src_port": 29752, "dest_port": 2726}}');
INSERT INTO alerts VALUES(1152,1773038272.597187043,'{"timestamp": "2026-03-09T07:37:52.597187+0100", "flow_id": 31627952361435, "event_type": "alert", "src_ip": "205.210.31.70", "src_port": 52362, "dest_ip": "134.19.55.199", "dest_port": 8883, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:37:52.597187+0100", "src_ip": "205.210.31.70", "dest_ip": "134.19.55.199", "src_port": 52362, "dest_port": 8883}}');
INSERT INTO alerts VALUES(1153,1773038353.565642119,'{"timestamp": "2026-03-09T07:39:13.565642+0100", "flow_id": 459090235937030, "event_type": "alert", "src_ip": "193.163.125.183", "src_port": 59097, "dest_ip": "134.19.55.199", "dest_port": 32080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:39:13.565642+0100", "src_ip": "193.163.125.183", "dest_ip": "134.19.55.199", "src_port": 59097, "dest_port": 32080}}');
INSERT INTO alerts VALUES(1154,1773038360.810590028,'{"timestamp": "2026-03-09T07:39:20.810590+0100", "flow_id": 103759240205580, "event_type": "alert", "src_ip": "65.49.1.223", "src_port": 38175, "dest_ip": "134.19.55.199", "dest_port": 32400, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:39:20.810590+0100", "src_ip": "65.49.1.223", "dest_ip": "134.19.55.199", "src_port": 38175, "dest_port": 32400}}');
INSERT INTO alerts VALUES(1155,1773038441.5640409,'{"timestamp": "2026-03-09T07:40:41.564041+0100", "flow_id": 452215921122882, "event_type": "alert", "src_ip": "193.163.125.185", "src_port": 53635, "dest_ip": "134.19.55.199", "dest_port": 20210, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:40:41.564041+0100", "src_ip": "193.163.125.185", "dest_ip": "134.19.55.199", "src_port": 53635, "dest_port": 20210}}');
INSERT INTO alerts VALUES(1156,1773038442.914798974,'{"timestamp": "2026-03-09T07:40:42.914799+0100", "flow_id": 832810564325164, "event_type": "alert", "src_ip": "147.185.132.159", "src_port": 51179, "dest_ip": "134.19.55.199", "dest_port": 9091, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:40:42.914799+0100", "src_ip": "147.185.132.159", "dest_ip": "134.19.55.199", "src_port": 51179, "dest_port": 9091}}');
INSERT INTO alerts VALUES(1157,1773038448.446094037,'{"timestamp": "2026-03-09T07:40:48.446094+0100", "flow_id": 227109393256947, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 29726, "dest_ip": "134.19.55.199", "dest_port": 25563, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:40:48.446094+0100", "src_ip": "167.94.146.38", "dest_ip": "134.19.55.199", "src_port": 29726, "dest_port": 25563}}');
INSERT INTO alerts VALUES(1158,1773038448.859844923,'{"timestamp": "2026-03-09T07:40:48.859845+0100", "flow_id": 33833523309455, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 45404, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:40:48.859845+0100", "src_ip": "45.156.87.127", "dest_ip": "134.19.55.199", "src_port": 45404, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1159,1773038448.859844923,'{"timestamp": "2026-03-09T07:40:48.859845+0100", "flow_id": 33833523309455, "event_type": "alert", "src_ip": "45.156.87.127", "src_port": 45404, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:40:48.859845+0100", "src_ip": "45.156.87.127", "dest_ip": "134.19.55.199", "src_port": 45404, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1160,1773038458.855185985,'{"timestamp": "2026-03-09T07:40:58.855186+0100", "flow_id": 576771324549822, "event_type": "alert", "src_ip": "176.65.149.219", "src_port": 63527, "dest_ip": "134.19.55.199", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 48, "bytes_toclient": 0, "start": "2026-03-09T07:40:58.855186+0100", "src_ip": "176.65.149.219", "dest_ip": "134.19.55.199", "src_port": 63527, "dest_port": 25565}}');
INSERT INTO alerts VALUES(1161,1773038490.595139027,'{"timestamp": "2026-03-09T07:41:30.595139+0100", "flow_id": 585779263511931, "event_type": "alert", "src_ip": "176.65.139.38", "src_port": 50000, "dest_ip": "134.19.55.199", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:41:30.595139+0100", "src_ip": "176.65.139.38", "dest_ip": "134.19.55.199", "src_port": 50000, "dest_port": 3000}}');
INSERT INTO alerts VALUES(1162,1773038531.0009861,'{"timestamp": "2026-03-09T07:42:11.000986+0100", "flow_id": 848663201682109, "event_type": "alert", "src_ip": "195.184.76.119", "src_port": 3603, "dest_ip": "134.19.55.199", "dest_port": 51001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:42:11.000986+0100", "src_ip": "195.184.76.119", "dest_ip": "134.19.55.199", "src_port": 3603, "dest_port": 51001}}');
INSERT INTO alerts VALUES(1163,1773038531.001373052,'{"timestamp": "2026-03-09T07:42:11.001373+0100", "flow_id": 850326174828447, "event_type": "alert", "src_ip": "176.65.139.41", "src_port": 50000, "dest_ip": "134.19.55.199", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:42:11.001373+0100", "src_ip": "176.65.139.41", "dest_ip": "134.19.55.199", "src_port": 50000, "dest_port": 3000}}');
INSERT INTO alerts VALUES(1164,1773038577.00467205,'{"timestamp": "2026-03-09T07:42:57.004672+0100", "flow_id": 301544515763882, "event_type": "alert", "src_ip": "193.163.125.186", "src_port": 35713, "dest_ip": "134.19.55.199", "dest_port": 104, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:42:57.004672+0100", "src_ip": "193.163.125.186", "dest_ip": "134.19.55.199", "src_port": 35713, "dest_port": 104}}');
INSERT INTO alerts VALUES(1165,1773038685.535547019,'{"timestamp": "2026-03-09T07:44:45.535547+0100", "flow_id": 1455734575230644, "event_type": "alert", "src_ip": "64.62.156.12", "src_port": 54084, "dest_ip": "134.19.55.199", "dest_port": 6025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:44:45.535547+0100", "src_ip": "64.62.156.12", "dest_ip": "134.19.55.199", "src_port": 54084, "dest_port": 6025}}');
INSERT INTO alerts VALUES(1166,1773038687.252326965,'{"timestamp": "2026-03-09T07:44:47.252327+0100", "flow_id": 2209640290980487, "event_type": "alert", "src_ip": "79.124.40.82", "src_port": 40097, "dest_ip": "134.19.55.199", "dest_port": 9898, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:44:47.252327+0100", "src_ip": "79.124.40.82", "dest_ip": "134.19.55.199", "src_port": 40097, "dest_port": 9898}}');
INSERT INTO alerts VALUES(1167,1773038824.880064965,'{"timestamp": "2026-03-09T07:47:04.880065+0100", "flow_id": 120677573821171, "event_type": "alert", "src_ip": "198.235.24.48", "src_port": 28654, "dest_ip": "134.19.55.199", "dest_port": 12446, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-09T07:47:04.880065+0100", "src_ip": "198.235.24.48", "dest_ip": "134.19.55.199", "src_port": 28654, "dest_port": 12446}}');
INSERT INTO alerts VALUES(1168,1773038920.662538051,'{"timestamp": "2026-03-09T07:48:40.662538+0100", "flow_id": 30831442376261, "event_type": "alert", "src_ip": "167.94.138.135", "src_port": 36546, "dest_ip": "134.19.55.199", "dest_port": 3784, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 64, "bytes_toclient": 0, "start": "2026-03-09T07:48:40.662538+0100", "src_ip": "167.94.138.135", "dest_ip": "134.19.55.199", "src_port": 36546, "dest_port": 3784}}');
INSERT INTO alerts VALUES(1169,1773038933.941262007,'{"timestamp": "2026-03-09T07:48:53.941262+0100", "flow_id": 1509415026953604, "event_type": "alert", "src_ip": "45.153.34.158", "src_port": 52198, "dest_ip": "134.19.55.199", "dest_port": 50555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T07:48:53.941262+0100", "src_ip": "45.153.34.158", "dest_ip": "134.19.55.199", "src_port": 52198, "dest_port": 50555}}');
INSERT INTO alerts VALUES(1170,1773038935.271953106,'{"timestamp": "2026-03-09T07:48:55.271953+0100", "flow_id": 2012455255066568, "event_type": "alert", "src_ip": "91.196.152.125", "src_port": 6575, "dest_ip": "134.19.55.199", "dest_port": 199, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:48:55.271953+0100", "src_ip": "91.196.152.125", "dest_ip": "134.19.55.199", "src_port": 6575, "dest_port": 199}}');
INSERT INTO alerts VALUES(1171,1773038936.326112031,'{"timestamp": "2026-03-09T07:48:56.326112+0100", "flow_id": 274741625216137, "event_type": "alert", "src_ip": "65.49.1.83", "src_port": 42170, "dest_ip": "134.19.55.199", "dest_port": 23856, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:48:56.326112+0100", "src_ip": "65.49.1.83", "dest_ip": "134.19.55.199", "src_port": 42170, "dest_port": 23856}}');
INSERT INTO alerts VALUES(1172,1773038956.561126947,'{"timestamp": "2026-03-09T07:49:16.561127+0100", "flow_id": 1284124290224199, "event_type": "alert", "src_ip": "185.196.8.218", "src_port": 46444, "dest_ip": "134.19.55.199", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:49:16.561127+0100", "src_ip": "185.196.8.218", "dest_ip": "134.19.55.199", "src_port": 46444, "dest_port": 5900}}');
INSERT INTO alerts VALUES(1173,1773038981.722251892,'{"timestamp": "2026-03-09T07:49:41.722252+0100", "flow_id": 1413199055336273, "event_type": "alert", "src_ip": "167.94.138.145", "src_port": 52059, "dest_ip": "134.19.55.199", "dest_port": 6007, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:49:41.722252+0100", "src_ip": "167.94.138.145", "dest_ip": "134.19.55.199", "src_port": 52059, "dest_port": 6007}}');
INSERT INTO alerts VALUES(1174,1773039016.064615011,'{"timestamp": "2026-03-09T07:50:16.064615+0100", "flow_id": 277522222656247, "event_type": "alert", "src_ip": "205.210.31.252", "src_port": 54903, "dest_ip": "134.19.55.199", "dest_port": 427, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:50:16.064615+0100", "src_ip": "205.210.31.252", "dest_ip": "134.19.55.199", "src_port": 54903, "dest_port": 427}}');
INSERT INTO alerts VALUES(1175,1773039029.418628931,'{"timestamp": "2026-03-09T07:50:29.418629+0100", "flow_id": 1516524827598597, "event_type": "alert", "src_ip": "64.62.156.195", "src_port": 59974, "dest_ip": "134.19.55.199", "dest_port": 24156, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:50:29.418629+0100", "src_ip": "64.62.156.195", "dest_ip": "134.19.55.199", "src_port": 59974, "dest_port": 24156}}');
INSERT INTO alerts VALUES(1176,1773039032.323159933,'{"timestamp": "2026-03-09T07:50:32.323160+0100", "flow_id": 262062278779289, "event_type": "alert", "src_ip": "205.210.31.43", "src_port": 55103, "dest_ip": "134.19.55.199", "dest_port": 60000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:50:32.323160+0100", "src_ip": "205.210.31.43", "dest_ip": "134.19.55.199", "src_port": 55103, "dest_port": 60000}}');
INSERT INTO alerts VALUES(1177,1773039072.49159789,'{"timestamp": "2026-03-09T07:51:12.491598+0100", "flow_id": 141075161410690, "event_type": "alert", "src_ip": "178.20.210.151", "src_port": 52907, "dest_ip": "134.19.55.199", "dest_port": 6000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:51:12.491598+0100", "src_ip": "178.20.210.151", "dest_ip": "134.19.55.199", "src_port": 52907, "dest_port": 6000}}');
INSERT INTO alerts VALUES(1178,1773039127.646756887,'{"timestamp": "2026-03-09T07:52:07.646757+0100", "flow_id": 2214853923193606, "event_type": "alert", "src_ip": "198.235.24.45", "src_port": 50944, "dest_ip": "134.19.55.199", "dest_port": 23, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:52:07.646757+0100", "src_ip": "198.235.24.45", "dest_ip": "134.19.55.199", "src_port": 50944, "dest_port": 23}}');
INSERT INTO alerts VALUES(1179,1773039178.921053887,'{"timestamp": "2026-03-09T07:52:58.921054+0100", "flow_id": 578199549243222, "event_type": "alert", "src_ip": "167.94.138.106", "src_port": 43434, "dest_ip": "134.19.55.199", "dest_port": 2131, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:52:58.921054+0100", "src_ip": "167.94.138.106", "dest_ip": "134.19.55.199", "src_port": 43434, "dest_port": 2131}}');
INSERT INTO alerts VALUES(1180,1773039227.552604914,'{"timestamp": "2026-03-09T07:53:47.552605+0100", "flow_id": 966049589504534, "event_type": "alert", "src_ip": "167.94.146.34", "src_port": 12431, "dest_ip": "134.19.55.199", "dest_port": 49795, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:53:47.552605+0100", "src_ip": "167.94.146.34", "dest_ip": "134.19.55.199", "src_port": 12431, "dest_port": 49795}}');
INSERT INTO alerts VALUES(1181,1773039275.171320915,'{"timestamp": "2026-03-09T07:54:35.171321+0100", "flow_id": 1017295798559502, "event_type": "alert", "src_ip": "167.94.146.41", "src_port": 64212, "dest_ip": "134.19.55.199", "dest_port": 62134, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:54:35.171321+0100", "src_ip": "167.94.146.41", "dest_ip": "134.19.55.199", "src_port": 64212, "dest_port": 62134}}');
INSERT INTO alerts VALUES(1182,1773039293.737180948,'{"timestamp": "2026-03-09T07:54:53.737181+0100", "flow_id": 1477322368741951, "event_type": "alert", "src_ip": "185.242.226.81", "src_port": 33579, "dest_ip": "134.19.55.199", "dest_port": 40798, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:54:53.737181+0100", "src_ip": "185.242.226.81", "dest_ip": "134.19.55.199", "src_port": 33579, "dest_port": 40798}}');
INSERT INTO alerts VALUES(1183,1773039335.652039052,'{"timestamp": "2026-03-09T07:55:35.652039+0100", "flow_id": 2237537046609436, "event_type": "alert", "src_ip": "193.163.125.210", "src_port": 56706, "dest_ip": "134.19.55.199", "dest_port": 1080, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:55:35.652039+0100", "src_ip": "193.163.125.210", "dest_ip": "134.19.55.199", "src_port": 56706, "dest_port": 1080}}');
INSERT INTO alerts VALUES(1184,1773039374.802691936,'{"timestamp": "2026-03-09T07:56:14.802692+0100", "flow_id": 1758687838509561, "event_type": "alert", "src_ip": "167.172.140.78", "src_port": 50017, "dest_ip": "134.19.55.199", "dest_port": 1521, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010936, "rev": 3, "signature": "ET SCAN Suspicious inbound to Oracle SQL port 1521", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:56:14.802692+0100", "src_ip": "167.172.140.78", "dest_ip": "134.19.55.199", "src_port": 50017, "dest_port": 1521}}');
INSERT INTO alerts VALUES(1185,1773039398.799643993,'{"timestamp": "2026-03-09T07:56:38.799644+0100", "flow_id": 1745597576971865, "event_type": "alert", "src_ip": "167.94.146.32", "src_port": 41686, "dest_ip": "134.19.55.199", "dest_port": 38278, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:56:38.799644+0100", "src_ip": "167.94.146.32", "dest_ip": "134.19.55.199", "src_port": 41686, "dest_port": 38278}}');
INSERT INTO alerts VALUES(1186,1773039406.671096086,'{"timestamp": "2026-03-09T07:56:46.671096+0100", "flow_id": 1756436827273456, "event_type": "alert", "src_ip": "91.224.92.177", "src_port": 47996, "dest_ip": "134.19.55.199", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400013, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 14", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:56:46.671096+0100", "src_ip": "91.224.92.177", "dest_ip": "134.19.55.199", "src_port": 47996, "dest_port": 3001}}');
INSERT INTO alerts VALUES(1187,1773039407.807941913,'{"timestamp": "2026-03-09T07:56:47.807942+0100", "flow_id": 2062711237077920, "event_type": "alert", "src_ip": "167.94.146.39", "src_port": 28710, "dest_ip": "134.19.55.199", "dest_port": 56830, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:56:47.807942+0100", "src_ip": "167.94.146.39", "dest_ip": "134.19.55.199", "src_port": 28710, "dest_port": 56830}}');
INSERT INTO alerts VALUES(1188,1773039477.700181962,'{"timestamp": "2026-03-09T07:57:57.700182+0100", "flow_id": 1599884781228052, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 52818, "dest_ip": "134.19.55.199", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:57:57.700182+0100", "src_ip": "185.242.246.36", "dest_ip": "134.19.55.199", "src_port": 52818, "dest_port": 22}}');
INSERT INTO alerts VALUES(1189,1773039477.700181962,'{"timestamp": "2026-03-09T07:57:57.700182+0100", "flow_id": 1599884781228052, "event_type": "alert", "src_ip": "185.242.246.36", "src_port": 52818, "dest_ip": "134.19.55.199", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:57:57.700182+0100", "src_ip": "185.242.246.36", "dest_ip": "134.19.55.199", "src_port": 52818, "dest_port": 22}}');
INSERT INTO alerts VALUES(1190,1773039510.844588041,'{"timestamp": "2026-03-09T07:58:30.844588+0100", "flow_id": 1938631062943316, "event_type": "alert", "src_ip": "65.49.1.18", "src_port": 59252, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:58:30.844588+0100", "src_ip": "65.49.1.18", "dest_ip": "134.19.55.199", "src_port": 59252, "dest_port": 80}}');
INSERT INTO alerts VALUES(1191,1773039548.650486947,'{"timestamp": "2026-03-09T07:59:08.650487+0100", "flow_id": 1386448789540171, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 52166, "dest_ip": "134.19.55.199", "dest_port": 1025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:59:08.650487+0100", "src_ip": "185.242.246.38", "dest_ip": "134.19.55.199", "src_port": 52166, "dest_port": 1025}}');
INSERT INTO alerts VALUES(1192,1773039548.650486947,'{"timestamp": "2026-03-09T07:59:08.650487+0100", "flow_id": 1386448789540171, "event_type": "alert", "src_ip": "185.242.246.38", "src_port": 52166, "dest_ip": "134.19.55.199", "dest_port": 1025, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:59:08.650487+0100", "src_ip": "185.242.246.38", "dest_ip": "134.19.55.199", "src_port": 52166, "dest_port": 1025}}');
INSERT INTO alerts VALUES(1193,1773039560.249886035,'{"timestamp": "2026-03-09T07:59:20.249886+0100", "flow_id": 228830405815244, "event_type": "alert", "src_ip": "198.235.24.194", "src_port": 56726, "dest_ip": "134.19.55.199", "dest_port": 30005, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T07:59:20.249886+0100", "src_ip": "198.235.24.194", "dest_ip": "134.19.55.199", "src_port": 56726, "dest_port": 30005}}');
INSERT INTO alerts VALUES(1194,1773039563.210803985,'{"timestamp": "2026-03-09T07:59:23.210804+0100", "flow_id": 905399552304265, "event_type": "alert", "src_ip": "195.184.76.143", "src_port": 62546, "dest_ip": "134.19.55.199", "dest_port": 5065, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T07:59:23.210804+0100", "src_ip": "195.184.76.143", "dest_ip": "134.19.55.199", "src_port": 62546, "dest_port": 5065}}');
INSERT INTO alerts VALUES(1195,1773039569.058463096,'{"timestamp": "2026-03-09T07:59:29.058463+0100", "flow_id": 532572567501979, "event_type": "alert", "src_ip": "176.65.134.20", "src_port": 46210, "dest_ip": "134.19.55.199", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T07:59:29.058463+0100", "src_ip": "176.65.134.20", "dest_ip": "134.19.55.199", "src_port": 46210, "dest_port": 443}}');
INSERT INTO alerts VALUES(1196,1773039611.761339903,'{"timestamp": "2026-03-09T08:00:11.761340+0100", "flow_id": 1018131723655715, "event_type": "alert", "src_ip": "198.235.24.122", "src_port": 50677, "dest_ip": "134.19.55.199", "dest_port": 54041, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:00:11.761340+0100", "src_ip": "198.235.24.122", "dest_ip": "134.19.55.199", "src_port": 50677, "dest_port": 54041}}');
INSERT INTO alerts VALUES(1197,1773039677.33924508,'{"timestamp": "2026-03-09T08:01:17.339245+0100", "flow_id": 1457046678097690, "event_type": "alert", "src_ip": "167.94.146.45", "src_port": 48311, "dest_ip": "134.19.55.199", "dest_port": 30725, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:01:17.339245+0100", "src_ip": "167.94.146.45", "dest_ip": "134.19.55.199", "src_port": 48311, "dest_port": 30725}}');
INSERT INTO alerts VALUES(1198,1773039702.635391951,'{"timestamp": "2026-03-09T08:01:42.635392+0100", "flow_id": 1884563874434118, "event_type": "alert", "src_ip": "195.184.76.161", "src_port": 21137, "dest_ip": "134.19.55.199", "dest_port": 5503, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:01:42.635392+0100", "src_ip": "195.184.76.161", "dest_ip": "134.19.55.199", "src_port": 21137, "dest_port": 5503}}');
INSERT INTO alerts VALUES(1199,1773039722.697057963,'{"timestamp": "2026-03-09T08:02:02.697058+0100", "flow_id": 742045024606951, "event_type": "alert", "src_ip": "147.185.132.52", "src_port": 52132, "dest_ip": "134.19.55.199", "dest_port": 1200, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:02:02.697058+0100", "src_ip": "147.185.132.52", "dest_ip": "134.19.55.199", "src_port": 52132, "dest_port": 1200}}');
INSERT INTO alerts VALUES(1200,1773039737.755600929,'{"timestamp": "2026-03-09T08:02:17.755601+0100", "flow_id": 430532058353827, "event_type": "alert", "src_ip": "176.65.148.199", "src_port": 50311, "dest_ip": "134.19.55.199", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 220, "bytes_toclient": 0, "start": "2026-03-09T08:02:17.755601+0100", "src_ip": "176.65.148.199", "dest_ip": "134.19.55.199", "src_port": 50311, "dest_port": 123}}');
INSERT INTO alerts VALUES(1201,1773039737.755600929,'{"timestamp": "2026-03-09T08:02:17.755601+0100", "flow_id": 430532058353827, "event_type": "alert", "src_ip": "176.65.148.199", "src_port": 50311, "dest_ip": "134.19.55.199", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 220, "bytes_toclient": 0, "start": "2026-03-09T08:02:17.755601+0100", "src_ip": "176.65.148.199", "dest_ip": "134.19.55.199", "src_port": 50311, "dest_port": 123}}');
INSERT INTO alerts VALUES(1202,1773039776.867799043,'{"timestamp": "2026-03-09T08:02:56.867799+0100", "flow_id": 67995517604268, "event_type": "alert", "src_ip": "64.62.197.240", "src_port": 46827, "dest_ip": "134.19.55.199", "dest_port": 17, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-09T08:02:56.867799+0100", "src_ip": "64.62.197.240", "dest_ip": "134.19.55.199", "src_port": 46827, "dest_port": 17}}');
INSERT INTO alerts VALUES(1203,1773039799.317321062,'{"timestamp": "2026-03-09T08:03:19.317321+0100", "flow_id": 2207308382666080, "event_type": "alert", "src_ip": "193.163.125.190", "src_port": 50119, "dest_ip": "134.19.55.199", "dest_port": 31402, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:03:19.317321+0100", "src_ip": "193.163.125.190", "dest_ip": "134.19.55.199", "src_port": 50119, "dest_port": 31402}}');
INSERT INTO alerts VALUES(1204,1773039822.215146064,'{"timestamp": "2026-03-09T08:03:42.215146+0100", "flow_id": 1768471430343076, "event_type": "alert", "src_ip": "116.206.241.146", "src_port": 56616, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:03:42.215146+0100", "src_ip": "116.206.241.146", "dest_ip": "134.19.55.199", "src_port": 56616, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1205,1773039871.350219011,'{"timestamp": "2026-03-09T08:04:31.350219+0100", "flow_id": 2067132897431087, "event_type": "alert", "src_ip": "162.217.98.180", "src_port": 52003, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2011716, "rev": 3, "signature": "ET SCAN Sipvicious User-Agent Detected (friendly-scanner)", "category": "Attempted Information Leak", "severity": 2, "metadata": {"confidence": ["High"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 414, "bytes_toclient": 0, "start": "2026-03-09T08:04:31.350219+0100", "src_ip": "162.217.98.180", "dest_ip": "134.19.55.199", "src_port": 52003, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1206,1773039874.382780076,'{"timestamp": "2026-03-09T08:04:34.382780+0100", "flow_id": 799604040482191, "event_type": "alert", "src_ip": "79.124.40.110", "src_port": 52537, "dest_ip": "134.19.55.199", "dest_port": 14602, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:04:34.382780+0100", "src_ip": "79.124.40.110", "dest_ip": "134.19.55.199", "src_port": 52537, "dest_port": 14602}}');
INSERT INTO alerts VALUES(1207,1773039875.69086194,'{"timestamp": "2026-03-09T08:04:35.690862+0100", "flow_id": 996906719723761, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 53936, "dest_ip": "134.19.55.199", "dest_port": 19654, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:04:35.690862+0100", "src_ip": "192.109.200.219", "dest_ip": "134.19.55.199", "src_port": 53936, "dest_port": 19654}}');
INSERT INTO alerts VALUES(1208,1773039875.69086194,'{"timestamp": "2026-03-09T08:04:35.690862+0100", "flow_id": 996906719723761, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 53936, "dest_ip": "134.19.55.199", "dest_port": 19654, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:04:35.690862+0100", "src_ip": "192.109.200.219", "dest_ip": "134.19.55.199", "src_port": 53936, "dest_port": 19654}}');
INSERT INTO alerts VALUES(1209,1773039935.648847104,'{"timestamp": "2026-03-09T08:05:35.648847+0100", "flow_id": 2223829232983113, "event_type": "alert", "src_ip": "167.94.146.36", "src_port": 19742, "dest_ip": "134.19.55.199", "dest_port": 4684, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:05:35.648847+0100", "src_ip": "167.94.146.36", "dest_ip": "134.19.55.199", "src_port": 19742, "dest_port": 4684}}');
INSERT INTO alerts VALUES(1210,1773039938.041874886,'{"timestamp": "2026-03-09T08:05:38.041875+0100", "flow_id": 742801992182464, "event_type": "alert", "src_ip": "147.185.132.219", "src_port": 53685, "dest_ip": "134.19.55.199", "dest_port": 10259, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:05:38.041875+0100", "src_ip": "147.185.132.219", "dest_ip": "134.19.55.199", "src_port": 53685, "dest_port": 10259}}');
INSERT INTO alerts VALUES(1211,1773039994.91612506,'{"timestamp": "2026-03-09T08:06:34.916125+0100", "flow_id": 838503580370547, "event_type": "alert", "src_ip": "195.184.76.223", "src_port": 15186, "dest_ip": "134.19.55.199", "dest_port": 5134, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:06:34.916125+0100", "src_ip": "195.184.76.223", "dest_ip": "134.19.55.199", "src_port": 15186, "dest_port": 5134}}');
INSERT INTO alerts VALUES(1212,1773039996.820367098,'{"timestamp": "2026-03-09T08:06:36.820367+0100", "flow_id": 1271650271798537, "event_type": "alert", "src_ip": "198.235.24.113", "src_port": 54391, "dest_ip": "134.19.55.199", "dest_port": 83, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:06:36.820367+0100", "src_ip": "198.235.24.113", "dest_ip": "134.19.55.199", "src_port": 54391, "dest_port": 83}}');
INSERT INTO alerts VALUES(1213,1773040013.067867994,'{"timestamp": "2026-03-09T08:06:53.067868+0100", "flow_id": 1417392390430098, "event_type": "alert", "src_ip": "176.65.148.204", "src_port": 42722, "dest_ip": "134.19.55.199", "dest_port": 25593, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:06:53.067868+0100", "src_ip": "176.65.148.204", "dest_ip": "134.19.55.199", "src_port": 42722, "dest_port": 25593}}');
INSERT INTO alerts VALUES(1214,1773040013.067867994,'{"timestamp": "2026-03-09T08:06:53.067868+0100", "flow_id": 1417392390430098, "event_type": "alert", "src_ip": "176.65.148.204", "src_port": 42722, "dest_ip": "134.19.55.199", "dest_port": 25593, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:06:53.067868+0100", "src_ip": "176.65.148.204", "dest_ip": "134.19.55.199", "src_port": 42722, "dest_port": 25593}}');
INSERT INTO alerts VALUES(1215,1773040040.867050887,'{"timestamp": "2026-03-09T08:07:20.867051+0100", "flow_id": 64785257172452, "event_type": "alert", "src_ip": "64.62.156.156", "src_port": 57149, "dest_ip": "134.19.55.199", "dest_port": 3389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:07:20.867051+0100", "src_ip": "64.62.156.156", "dest_ip": "134.19.55.199", "src_port": 57149, "dest_port": 3389}}');
INSERT INTO alerts VALUES(1216,1773040042.437798024,'{"timestamp": "2026-03-09T08:07:22.437798+0100", "flow_id": 754432207696357, "event_type": "alert", "src_ip": "205.210.31.39", "src_port": 52353, "dest_ip": "134.19.55.199", "dest_port": 54528, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:07:22.437798+0100", "src_ip": "205.210.31.39", "dest_ip": "134.19.55.199", "src_port": 52353, "dest_port": 54528}}');
INSERT INTO alerts VALUES(1217,1773040046.91168189,'{"timestamp": "2026-03-09T08:07:26.911682+0100", "flow_id": 1945320149379775, "event_type": "alert", "src_ip": "46.151.182.45", "src_port": 40873, "dest_ip": "134.19.55.199", "dest_port": 20117, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:07:26.911682+0100", "src_ip": "46.151.182.45", "dest_ip": "134.19.55.199", "src_port": 40873, "dest_port": 20117}}');
INSERT INTO alerts VALUES(1218,1773040069.170989991,'{"timestamp": "2026-03-09T08:07:49.170990+0100", "flow_id": 1578822249248313, "event_type": "alert", "src_ip": "65.49.1.140", "src_port": 46348, "dest_ip": "134.19.55.199", "dest_port": 12546, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-09T08:07:49.170990+0100", "src_ip": "65.49.1.140", "dest_ip": "134.19.55.199", "src_port": 46348, "dest_port": 12546}}');
INSERT INTO alerts VALUES(1219,1773040080.41356206,'{"timestamp": "2026-03-09T08:08:00.413562+0100", "flow_id": 87388816867669, "event_type": "alert", "src_ip": "198.235.24.222", "src_port": 53873, "dest_ip": "134.19.55.199", "dest_port": 2379, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:08:00.413562+0100", "src_ip": "198.235.24.222", "dest_ip": "134.19.55.199", "src_port": 53873, "dest_port": 2379}}');
INSERT INTO alerts VALUES(1220,1773040108.611851931,'{"timestamp": "2026-03-09T08:08:28.611852+0100", "flow_id": 1220510476611222, "event_type": "alert", "src_ip": "192.109.200.219", "src_port": 59223, "dest_ip": "134.19.55.199", "dest_port": 20020, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2500020, "rev": 7553, "signature": "ET COMPROMISED Known Compromised or Hostile Host Traffic group 11", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2011_04_28"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["COMPROMISED"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:08:28.611852+0100", "src_ip": "192.109.200.219", "dest_ip": "134.19.55.199", "src_port": 59223, "dest_port": 20020}}');
INSERT INTO alerts VALUES(1221,1773040128.252794981,'{"timestamp": "2026-03-09T08:08:48.252795+0100", "flow_id": 241324241480974, "event_type": "alert", "src_ip": "147.185.132.63", "src_port": 52213, "dest_ip": "134.19.55.199", "dest_port": 389, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:08:48.252795+0100", "src_ip": "147.185.132.63", "dest_ip": "134.19.55.199", "src_port": 52213, "dest_port": 389}}');
INSERT INTO alerts VALUES(1222,1773040145.745502949,'{"timestamp": "2026-03-09T08:09:05.745503+0100", "flow_id": 387165337958083, "event_type": "alert", "src_ip": "65.49.1.227", "src_port": 39669, "dest_ip": "134.19.55.199", "dest_port": 21, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:09:05.745503+0100", "src_ip": "65.49.1.227", "dest_ip": "134.19.55.199", "src_port": 39669, "dest_port": 21}}');
INSERT INTO alerts VALUES(1223,1773040257.816510916,'{"timestamp": "2026-03-09T08:10:57.816511+0100", "flow_id": 410664507735585, "event_type": "alert", "src_ip": "79.124.62.134", "src_port": 55735, "dest_ip": "134.19.55.199", "dest_port": 42091, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:10:57.816511+0100", "src_ip": "79.124.62.134", "dest_ip": "134.19.55.199", "src_port": 55735, "dest_port": 42091}}');
INSERT INTO alerts VALUES(1224,1773040271.500108958,'{"timestamp": "2026-03-09T08:11:11.500109+0100", "flow_id": 2147955006571155, "event_type": "alert", "src_ip": "46.151.182.160", "src_port": 40173, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:11:11.500109+0100", "src_ip": "46.151.182.160", "dest_ip": "134.19.55.199", "src_port": 40173, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1225,1773040271.500108958,'{"timestamp": "2026-03-09T08:11:11.500109+0100", "flow_id": 2147955006571155, "event_type": "alert", "src_ip": "46.151.182.160", "src_port": 40173, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:11:11.500109+0100", "src_ip": "46.151.182.160", "dest_ip": "134.19.55.199", "src_port": 40173, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1226,1773040271.799360991,'{"timestamp": "2026-03-09T08:11:11.799361+0100", "flow_id": 2025858625180883, "event_type": "alert", "src_ip": "185.242.226.97", "src_port": 55400, "dest_ip": "134.19.55.199", "dest_port": 40975, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 29, "bytes_toclient": 0, "start": "2026-03-09T08:11:11.799361+0100", "src_ip": "185.242.226.97", "dest_ip": "134.19.55.199", "src_port": 55400, "dest_port": 40975}}');
INSERT INTO alerts VALUES(1227,1773040285.711632014,'{"timestamp": "2026-03-09T08:11:25.711632+0100", "flow_id": 1649063001803656, "event_type": "alert", "src_ip": "176.65.132.143", "src_port": 36677, "dest_ip": "134.19.55.199", "dest_port": 2815, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:11:25.711632+0100", "src_ip": "176.65.132.143", "dest_ip": "134.19.55.199", "src_port": 36677, "dest_port": 2815}}');
INSERT INTO alerts VALUES(1228,1773040287.615003109,'{"timestamp": "2026-03-09T08:11:27.615003+0100", "flow_id": 2078471032860648, "event_type": "alert", "src_ip": "205.210.31.40", "src_port": 52111, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:11:27.615003+0100", "src_ip": "205.210.31.40", "dest_ip": "134.19.55.199", "src_port": 52111, "dest_port": 80}}');
INSERT INTO alerts VALUES(1229,1773040302.220082044,'{"timestamp": "2026-03-09T08:11:42.220082+0100", "flow_id": 1789670360002776, "event_type": "alert", "src_ip": "205.210.31.69", "src_port": 51266, "dest_ip": "134.19.55.199", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:11:42.220082+0100", "src_ip": "205.210.31.69", "dest_ip": "134.19.55.199", "src_port": 51266, "dest_port": 5555}}');
INSERT INTO alerts VALUES(1230,1773040322.792069911,'{"timestamp": "2026-03-09T08:12:02.792070+0100", "flow_id": 587166320839110, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "134.19.55.199", "dest_port": 22808, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400023, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 24", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:12:02.792070+0100", "src_ip": "130.12.180.88", "dest_ip": "134.19.55.199", "src_port": 52302, "dest_port": 22808}}');
INSERT INTO alerts VALUES(1231,1773040322.792069911,'{"timestamp": "2026-03-09T08:12:02.792070+0100", "flow_id": 587166320839110, "event_type": "alert", "src_ip": "130.12.180.88", "src_port": 52302, "dest_ip": "134.19.55.199", "dest_port": 22808, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:12:02.792070+0100", "src_ip": "130.12.180.88", "dest_ip": "134.19.55.199", "src_port": 52302, "dest_port": 22808}}');
INSERT INTO alerts VALUES(1232,1773040345.620853901,'{"timestamp": "2026-03-09T08:12:25.620854+0100", "flow_id": 414750391926245, "event_type": "alert", "src_ip": "66.132.153.151", "src_port": 51707, "dest_ip": "134.19.55.199", "dest_port": 17186, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 92, "bytes_toclient": 0, "start": "2026-03-09T08:12:25.620854+0100", "src_ip": "66.132.153.151", "dest_ip": "134.19.55.199", "src_port": 51707, "dest_port": 17186}}');
INSERT INTO alerts VALUES(1233,1773040395.581067085,'{"timestamp": "2026-03-09T08:13:15.581067+0100", "flow_id": 1088291421242003, "event_type": "alert", "src_ip": "176.65.149.45", "src_port": 51327, "dest_ip": "134.19.55.199", "dest_port": 8081, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:13:15.581067+0100", "src_ip": "176.65.149.45", "dest_ip": "134.19.55.199", "src_port": 51327, "dest_port": 8081}}');
INSERT INTO alerts VALUES(1234,1773040396.852627038,'{"timestamp": "2026-03-09T08:13:16.852627+0100", "flow_id": 1128732110910352, "event_type": "alert", "src_ip": "198.235.24.110", "src_port": 51527, "dest_ip": "134.19.55.199", "dest_port": 2525, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:13:16.852627+0100", "src_ip": "198.235.24.110", "dest_ip": "134.19.55.199", "src_port": 51527, "dest_port": 2525}}');
INSERT INTO alerts VALUES(1235,1773040397.351819038,'{"timestamp": "2026-03-09T08:13:17.351819+0100", "flow_id": 1511052875369634, "event_type": "alert", "src_ip": "46.151.182.187", "src_port": 40238, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400006, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 7", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:13:17.351819+0100", "src_ip": "46.151.182.187", "dest_ip": "134.19.55.199", "src_port": 40238, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1236,1773040397.351819038,'{"timestamp": "2026-03-09T08:13:17.351819+0100", "flow_id": 1511052875369634, "event_type": "alert", "src_ip": "46.151.182.187", "src_port": 40238, "dest_ip": "134.19.55.199", "dest_port": 3306, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2010937, "rev": 3, "signature": "ET SCAN Suspicious inbound to mySQL port 3306", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:13:17.351819+0100", "src_ip": "46.151.182.187", "dest_ip": "134.19.55.199", "src_port": 40238, "dest_port": 3306}}');
INSERT INTO alerts VALUES(1237,1773040410.096293926,'{"timestamp": "2026-03-09T08:13:30.096294+0100", "flow_id": 695056545007503, "event_type": "alert", "src_ip": "198.235.24.244", "src_port": 55043, "dest_ip": "134.19.55.199", "dest_port": 10000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:13:30.096294+0100", "src_ip": "198.235.24.244", "dest_ip": "134.19.55.199", "src_port": 55043, "dest_port": 10000}}');
INSERT INTO alerts VALUES(1238,1773040446.095185042,'{"timestamp": "2026-03-09T08:14:06.095185+0100", "flow_id": 1816192409743016, "event_type": "alert", "src_ip": "205.210.31.207", "src_port": 49322, "dest_ip": "134.19.55.199", "dest_port": 25827, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:14:06.095185+0100", "src_ip": "205.210.31.207", "dest_ip": "134.19.55.199", "src_port": 49322, "dest_port": 25827}}');
INSERT INTO alerts VALUES(1239,1773040451.893527985,'{"timestamp": "2026-03-09T08:14:11.893528+0100", "flow_id": 1022926160155108, "event_type": "alert", "src_ip": "198.235.24.54", "src_port": 55088, "dest_ip": "134.19.55.199", "dest_port": 21, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:14:11.893528+0100", "src_ip": "198.235.24.54", "dest_ip": "134.19.55.199", "src_port": 55088, "dest_port": 21}}');
INSERT INTO alerts VALUES(1240,1773040474.193777085,'{"timestamp": "2026-03-09T08:14:34.193777+0100", "flow_id": 832270160891229, "event_type": "alert", "src_ip": "195.184.76.76", "src_port": 5101, "dest_ip": "134.19.55.199", "dest_port": 21242, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:14:34.193777+0100", "src_ip": "195.184.76.76", "dest_ip": "134.19.55.199", "src_port": 5101, "dest_port": 21242}}');
INSERT INTO alerts VALUES(1241,1773040569.327961921,'{"timestamp": "2026-03-09T08:16:09.327962+0100", "flow_id": 282690442345109, "event_type": "alert", "src_ip": "167.94.138.146", "src_port": 1950, "dest_ip": "134.19.55.199", "dest_port": 17185, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 92, "bytes_toclient": 0, "start": "2026-03-09T08:16:09.327962+0100", "src_ip": "167.94.138.146", "dest_ip": "134.19.55.199", "src_port": 1950, "dest_port": 17185}}');
INSERT INTO alerts VALUES(1242,1773040580.172449111,'{"timestamp": "2026-03-09T08:16:20.172449+0100", "flow_id": 1303612902024532, "event_type": "alert", "src_ip": "182.8.196.168", "src_port": 61875, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:16:20.172449+0100", "src_ip": "182.8.196.168", "dest_ip": "134.19.55.199", "src_port": 61875, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1243,1773040599.070158005,'{"timestamp": "2026-03-09T08:16:39.070158+0100", "flow_id": 1990179096838814, "event_type": "alert", "src_ip": "64.89.163.244", "src_port": 40379, "dest_ip": "134.19.55.199", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:16:39.070158+0100", "src_ip": "64.89.163.244", "dest_ip": "134.19.55.199", "src_port": 40379, "dest_port": 27017}}');
INSERT INTO alerts VALUES(1244,1773040613.926537036,'{"timestamp": "2026-03-09T08:16:53.926537+0100", "flow_id": 1446174963685519, "event_type": "alert", "src_ip": "195.184.76.175", "src_port": 50688, "dest_ip": "134.19.55.199", "dest_port": 557, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:16:53.926537+0100", "src_ip": "195.184.76.175", "dest_ip": "134.19.55.199", "src_port": 50688, "dest_port": 557}}');
INSERT INTO alerts VALUES(1245,1773040622.872776985,'{"timestamp": "2026-03-09T08:17:02.872777+0100", "flow_id": 1778227658810771, "event_type": "alert", "src_ip": "147.185.132.75", "src_port": 54279, "dest_ip": "134.19.55.199", "dest_port": 23556, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:17:02.872777+0100", "src_ip": "147.185.132.75", "dest_ip": "134.19.55.199", "src_port": 54279, "dest_port": 23556}}');
INSERT INTO alerts VALUES(1246,1773040640.409400939,'{"timestamp": "2026-03-09T08:17:20.409401+0100", "flow_id": 63154151051705, "event_type": "alert", "src_ip": "35.172.245.152", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64494, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3718, "start": "2026-03-09T08:17:20.211312+0100", "src_ip": "192.168.2.37", "dest_ip": "35.172.245.152", "src_port": 64494, "dest_port": 443}}');
INSERT INTO alerts VALUES(1247,1773040640.51050806,'{"timestamp": "2026-03-09T08:17:20.510508+0100", "flow_id": 221049189559259, "event_type": "alert", "src_ip": "52.45.196.192", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64495, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3719, "start": "2026-03-09T08:17:20.313611+0100", "src_ip": "192.168.2.37", "dest_ip": "52.45.196.192", "src_port": 64495, "dest_port": 443}}');
INSERT INTO alerts VALUES(1248,1773040642.559329987,'{"timestamp": "2026-03-09T08:17:22.559330+0100", "flow_id": 799259026881546, "event_type": "alert", "src_ip": "50.16.211.97", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64499, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3718, "start": "2026-03-09T08:17:22.317163+0100", "src_ip": "192.168.2.37", "dest_ip": "50.16.211.97", "src_port": 64499, "dest_port": 443}}');
INSERT INTO alerts VALUES(1249,1773040644.521404027,'{"timestamp": "2026-03-09T08:17:24.521404+0100", "flow_id": 1389010381583101, "event_type": "alert", "src_ip": "34.199.234.25", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64508, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3718, "start": "2026-03-09T08:17:24.323404+0100", "src_ip": "192.168.2.37", "dest_ip": "34.199.234.25", "src_port": 64508, "dest_port": 443}}');
INSERT INTO alerts VALUES(1250,1773040646.520379067,'{"timestamp": "2026-03-09T08:17:26.520379+0100", "flow_id": 1961294632668276, "event_type": "alert", "src_ip": "54.83.110.109", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64509, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3719, "start": "2026-03-09T08:17:26.325577+0100", "src_ip": "192.168.2.37", "dest_ip": "54.83.110.109", "src_port": 64509, "dest_port": 443}}');
INSERT INTO alerts VALUES(1251,1773040648.534176111,'{"timestamp": "2026-03-09T08:17:28.534176+0100", "flow_id": 48970587830873, "event_type": "alert", "src_ip": "3.227.190.204", "src_port": 443, "dest_ip": "192.168.2.37", "dest_port": 64510, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2031231, "rev": 3, "signature": "ET INFO Observed ZeroSSL SSL/TLS Certificate", "category": "Misc activity", "severity": 3, "metadata": {"confidence": ["High"], "created_at": ["2020_11_23"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2022_12_01"]}}, "ts_progress": "client_handshake_done", "tc_progress": "server_handshake_done", "tls": {"subject": "CN=*.cheqzone.com", "issuerdn": "C=AT, O=ZeroSSL, CN=ZeroSSL ECC Domain Secure Site CA", "subjectaltname": ["*.cheqzone.com"], "serial": "00:DA:C9:89:D0:F2:15:4A:42:69:57:8A:B8:13:09:61:7A", "fingerprint": "59:95:e2:6e:bd:34:6f:42:1d:db:4d:53:cb:ed:04:c6:eb:f4:1c:2a", "sni": "obs.cheqzone.com", "version": "TLS 1.2", "notbefore": "2026-02-04T00:00:00", "notafter": "2026-05-05T23:59:59", "ja3": {"hash": "773906b0efdefa24a7f2b8eb6985bf37", "string": "771,4865-4866-4867-49196-49195-52393-49200-49199-52392-49162-49161-49172-49171-157-156-53-47-49160-49170-10,0-23-65281-10-11-16-5-13-18-51-45-43-27-21,29-23-24-25,0"}, "ja3s": {"hash": "80d47c47e3ce91bc3bd0a026dbd1664d", "string": "771,49196,5-65281-16"}, "ja4": "t13d2014h2_a09f3c656075_14788d8d241b", "client_alpns": ["h2", "http/1.1"], "server_alpns": ["h2"]}, "app_proto": "tls", "direction": "to_client", "flow": {"pkts_toserver": 3, "pkts_toclient": 5, "bytes_toserver": 685, "bytes_toclient": 3718, "start": "2026-03-09T08:17:28.339081+0100", "src_ip": "192.168.2.37", "dest_ip": "3.227.190.204", "src_port": 64510, "dest_port": 443}}');
INSERT INTO alerts VALUES(1252,1773040751.791302919,'{"timestamp": "2026-03-09T08:19:11.791303+0100", "flow_id": 1991249741933838, "event_type": "alert", "src_ip": "88.210.63.192", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 44350, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:19:11.791303+0100", "src_ip": "88.210.63.192", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 44350}}');
INSERT INTO alerts VALUES(1253,1773040757.067863942,'{"timestamp": "2026-03-09T08:19:17.067864+0100", "flow_id": 1417377473694561, "event_type": "alert", "src_ip": "193.163.125.199", "src_port": 41587, "dest_ip": "134.19.55.199", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:19:17.067864+0100", "src_ip": "193.163.125.199", "dest_ip": "134.19.55.199", "src_port": 41587, "dest_port": 27017}}');
INSERT INTO alerts VALUES(1254,1773040766.319267989,'{"timestamp": "2026-03-09T08:19:26.319268+0100", "flow_id": 1934196284869023, "event_type": "alert", "src_ip": "185.156.73.86", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 44366, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400034, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 35", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:19:26.319268+0100", "src_ip": "185.156.73.86", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 44366}}');
INSERT INTO alerts VALUES(1255,1773040795.66325903,'{"timestamp": "2026-03-09T08:19:55.663259+0100", "flow_id": 878354269268027, "event_type": "alert", "src_ip": "195.184.76.84", "src_port": 38823, "dest_ip": "134.19.55.199", "dest_port": 1701, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:19:55.663259+0100", "src_ip": "195.184.76.84", "dest_ip": "134.19.55.199", "src_port": 38823, "dest_port": 1701}}');
INSERT INTO alerts VALUES(1256,1773040802.787348031,'{"timestamp": "2026-03-09T08:20:02.787348+0100", "flow_id": 566885206029434, "event_type": "alert", "src_ip": "147.185.132.117", "src_port": 53882, "dest_ip": "134.19.55.199", "dest_port": 52590, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:20:02.787348+0100", "src_ip": "147.185.132.117", "dest_ip": "134.19.55.199", "src_port": 53882, "dest_port": 52590}}');
INSERT INTO alerts VALUES(1257,1773040821.892981052,'{"timestamp": "2026-03-09T08:20:21.892981+0100", "flow_id": 1583527321866087, "event_type": "alert", "src_ip": "193.163.125.202", "src_port": 59750, "dest_ip": "134.19.55.199", "dest_port": 38881, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:20:21.892981+0100", "src_ip": "193.163.125.202", "dest_ip": "134.19.55.199", "src_port": 59750, "dest_port": 38881}}');
INSERT INTO alerts VALUES(1258,1773040824.683183908,'{"timestamp": "2026-03-09T08:20:24.683184+0100", "flow_id": 119504796336149, "event_type": "alert", "src_ip": "198.235.24.254", "src_port": 50600, "dest_ip": "134.19.55.199", "dest_port": 123, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "ntp", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 76, "bytes_toclient": 0, "start": "2026-03-09T08:20:24.683184+0100", "src_ip": "198.235.24.254", "dest_ip": "134.19.55.199", "src_port": 50600, "dest_port": 123}}');
INSERT INTO alerts VALUES(1259,1773040857.843436003,'{"timestamp": "2026-03-09T08:20:57.843436+0100", "flow_id": 526307881926403, "event_type": "alert", "src_ip": "91.196.152.213", "src_port": 26038, "dest_ip": "134.19.55.199", "dest_port": 17754, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:20:57.843436+0100", "src_ip": "91.196.152.213", "dest_ip": "134.19.55.199", "src_port": 26038, "dest_port": 17754}}');
INSERT INTO alerts VALUES(1260,1773040858.916147948,'{"timestamp": "2026-03-09T08:20:58.916148+0100", "flow_id": 838605167066991, "event_type": "alert", "src_ip": "91.196.152.191", "src_port": 45436, "dest_ip": "134.19.55.199", "dest_port": 20014, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:20:58.916148+0100", "src_ip": "91.196.152.191", "dest_ip": "134.19.55.199", "src_port": 45436, "dest_port": 20014}}');
INSERT INTO alerts VALUES(1261,1773040868.873147964,'{"timestamp": "2026-03-09T08:21:08.873148+0100", "flow_id": 1216868862984754, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 47704, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 54806, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:21:08.873148+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 47704, "dest_port": 53}}');
INSERT INTO alerts VALUES(1262,1773040868.873148919,'{"timestamp": "2026-03-09T08:21:08.873149+0100", "flow_id": 1216871770274383, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 41744, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 11760, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:21:08.873149+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 41744, "dest_port": 53}}');
INSERT INTO alerts VALUES(1263,1773040872.309253931,'{"timestamp": "2026-03-09T08:21:12.309254+0100", "flow_id": 202337510225266, "event_type": "alert", "src_ip": "205.210.31.76", "src_port": 51916, "dest_ip": "134.19.55.199", "dest_port": 17516, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:21:12.309254+0100", "src_ip": "205.210.31.76", "dest_ip": "134.19.55.199", "src_port": 51916, "dest_port": 17516}}');
INSERT INTO alerts VALUES(1264,1773040876.148085117,'{"timestamp": "2026-03-09T08:21:16.148085+0100", "flow_id": 1198971761453944, "event_type": "alert", "src_ip": "205.210.31.253", "src_port": 51133, "dest_ip": "134.19.55.199", "dest_port": 10250, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:21:16.148085+0100", "src_ip": "205.210.31.253", "dest_ip": "134.19.55.199", "src_port": 51133, "dest_port": 10250}}');
INSERT INTO alerts VALUES(1265,1773040958.36405611,'{"timestamp": "2026-03-09T08:22:38.364056+0100", "flow_id": 1845087644613330, "event_type": "alert", "src_ip": "167.94.146.35", "src_port": 24082, "dest_ip": "134.19.55.199", "dest_port": 32668, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:22:38.364056+0100", "src_ip": "167.94.146.35", "dest_ip": "134.19.55.199", "src_port": 24082, "dest_port": 32668}}');
INSERT INTO alerts VALUES(1266,1773040990.759915113,'{"timestamp": "2026-03-09T08:23:10.759915+0100", "flow_id": 1856436995537501, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59681, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 59922, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:23:10.759915+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59681, "dest_port": 53}}');
INSERT INTO alerts VALUES(1267,1773040990.759916067,'{"timestamp": "2026-03-09T08:23:10.759916+0100", "flow_id": 1856440529942438, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 39405, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 2502, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:23:10.759916+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 39405, "dest_port": 53}}');
INSERT INTO alerts VALUES(1268,1773040990.760206937,'{"timestamp": "2026-03-09T08:23:10.760207+0100", "flow_id": 1857692368689743, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 39483, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 38284, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:23:10.760207+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 39483, "dest_port": 53}}');
INSERT INTO alerts VALUES(1269,1773041008.91616106,'{"timestamp": "2026-03-09T08:23:28.916161+0100", "flow_id": 275708336979879, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 33869, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 60175, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:23:28.916161+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 33869, "dest_port": 53}}');
INSERT INTO alerts VALUES(1270,1773041008.91616106,'{"timestamp": "2026-03-09T08:23:28.916161+0100", "flow_id": 275710868768324, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59927, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 16380, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:23:28.916161+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59927, "dest_port": 53}}');
INSERT INTO alerts VALUES(1271,1773041067.202440977,'{"timestamp": "2026-03-09T08:24:27.202441+0100", "flow_id": 869480543312571, "event_type": "alert", "src_ip": "167.94.138.129", "src_port": 47516, "dest_ip": "134.19.55.199", "dest_port": 9142, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:24:27.202441+0100", "src_ip": "167.94.138.129", "dest_ip": "134.19.55.199", "src_port": 47516, "dest_port": 9142}}');
INSERT INTO alerts VALUES(1272,1773041096.384428978,'{"timestamp": "2026-03-09T08:24:56.384429+0100", "flow_id": 243736419701380, "event_type": "alert", "src_ip": "167.94.146.42", "src_port": 8475, "dest_ip": "134.19.55.199", "dest_port": 31858, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:24:56.384429+0100", "src_ip": "167.94.146.42", "dest_ip": "134.19.55.199", "src_port": 8475, "dest_port": 31858}}');
INSERT INTO alerts VALUES(1273,1773041148.964375973,'{"timestamp": "2026-03-09T08:25:48.964376+0100", "flow_id": 1327215587459947, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 34875, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 23253, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:25:48.964376+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 34875, "dest_port": 53}}');
INSERT INTO alerts VALUES(1274,1773041148.964376926,'{"timestamp": "2026-03-09T08:25:48.964377+0100", "flow_id": 1327221745406649, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 34900, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 19988, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:25:48.964377+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 34900, "dest_port": 53}}');
INSERT INTO alerts VALUES(1275,1773041162.195710898,'{"timestamp": "2026-03-09T08:26:02.195711+0100", "flow_id": 840575139528657, "event_type": "alert", "src_ip": "198.235.24.121", "src_port": 51038, "dest_ip": "134.19.55.199", "dest_port": 10002, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:26:02.195711+0100", "src_ip": "198.235.24.121", "dest_ip": "134.19.55.199", "src_port": 51038, "dest_port": 10002}}');
INSERT INTO alerts VALUES(1276,1773041189.314227105,'{"timestamp": "2026-03-09T08:26:29.314227+0100", "flow_id": 1631070940427396, "event_type": "alert", "src_ip": "14.222.46.148", "src_port": 53530, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:26:29.314227+0100", "src_ip": "14.222.46.148", "dest_ip": "134.19.55.199", "src_port": 53530, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1277,1773041202.865797996,'{"timestamp": "2026-03-09T08:26:42.865798+0100", "flow_id": 622350102821743, "event_type": "alert", "src_ip": "185.93.89.79", "src_port": 54679, "dest_ip": "134.19.55.199", "dest_port": 4444, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400033, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 34", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:26:42.865798+0100", "src_ip": "185.93.89.79", "dest_ip": "134.19.55.199", "src_port": 54679, "dest_port": 4444}}');
INSERT INTO alerts VALUES(1278,1773041256.545604944,'{"timestamp": "2026-03-09T08:27:36.545605+0100", "flow_id": 91559081188074, "event_type": "alert", "src_ip": "64.62.156.198", "src_port": 47498, "dest_ip": "134.19.55.199", "dest_port": 8443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:27:36.545605+0100", "src_ip": "64.62.156.198", "dest_ip": "134.19.55.199", "src_port": 47498, "dest_port": 8443}}');
INSERT INTO alerts VALUES(1279,1773041279.871537923,'{"timestamp": "2026-03-09T08:27:59.871538+0100", "flow_id": 2054378171390796, "event_type": "alert", "src_ip": "64.89.163.85", "src_port": 41156, "dest_ip": "134.19.55.199", "dest_port": 27017, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400007, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 8", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:27:59.871538+0100", "src_ip": "64.89.163.85", "dest_ip": "134.19.55.199", "src_port": 41156, "dest_port": 27017}}');
INSERT INTO alerts VALUES(1280,1773041289.013734103,'{"timestamp": "2026-03-09T08:28:09.013734+0100", "flow_id": 340466134881160, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59269, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 24513, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:28:09.013734+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59269, "dest_port": 53}}');
INSERT INTO alerts VALUES(1281,1773041289.014020919,'{"timestamp": "2026-03-09T08:28:09.014021+0100", "flow_id": 341697793652758, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 51009, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 25098, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:28:09.014021+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 51009, "dest_port": 53}}');
INSERT INTO alerts VALUES(1282,1773041290.671058894,'{"timestamp": "2026-03-09T08:28:10.671059+0100", "flow_id": 630377447166040, "event_type": "alert", "src_ip": "195.184.76.129", "src_port": 31242, "dest_ip": "134.19.55.199", "dest_port": 6717, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:28:10.671059+0100", "src_ip": "195.184.76.129", "dest_ip": "134.19.55.199", "src_port": 31242, "dest_port": 6717}}');
INSERT INTO alerts VALUES(1283,1773041314.347446919,'{"timestamp": "2026-03-09T08:28:34.347447+0100", "flow_id": 647849948446045, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "134.19.55.199", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:28:34.347447+0100", "src_ip": "204.76.203.215", "dest_ip": "134.19.55.199", "src_port": 40000, "dest_port": 3001}}');
INSERT INTO alerts VALUES(1284,1773041314.347446919,'{"timestamp": "2026-03-09T08:28:34.347447+0100", "flow_id": 647849948446045, "event_type": "alert", "src_ip": "204.76.203.215", "src_port": 40000, "dest_ip": "134.19.55.199", "dest_port": 3001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:28:34.347447+0100", "src_ip": "204.76.203.215", "dest_ip": "134.19.55.199", "src_port": 40000, "dest_port": 3001}}');
INSERT INTO alerts VALUES(1285,1773041347.472271919,'{"timestamp": "2026-03-09T08:29:07.472272+0100", "flow_id": 902493768382772, "event_type": "alert", "src_ip": "45.142.154.70", "src_port": 58914, "dest_ip": "134.19.55.199", "dest_port": 36816, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:29:07.472272+0100", "src_ip": "45.142.154.70", "dest_ip": "134.19.55.199", "src_port": 58914, "dest_port": 36816}}');
INSERT INTO alerts VALUES(1286,1773041368.282804012,'{"timestamp": "2026-03-09T08:29:28.282804+0100", "flow_id": 88735751110974, "event_type": "alert", "src_ip": "147.185.132.70", "src_port": 52761, "dest_ip": "134.19.55.199", "dest_port": 10000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:29:28.282804+0100", "src_ip": "147.185.132.70", "dest_ip": "134.19.55.199", "src_port": 52761, "dest_port": 10000}}');
INSERT INTO alerts VALUES(1287,1773041402.644164086,'{"timestamp": "2026-03-09T08:30:02.644164+0100", "flow_id": 796341428078655, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 54772, "dest_ip": "134.19.55.199", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:30:02.644164+0100", "src_ip": "185.242.246.37", "dest_ip": "134.19.55.199", "src_port": 54772, "dest_port": 10001}}');
INSERT INTO alerts VALUES(1288,1773041402.644164086,'{"timestamp": "2026-03-09T08:30:02.644164+0100", "flow_id": 796341428078655, "event_type": "alert", "src_ip": "185.242.246.37", "src_port": 54772, "dest_ip": "134.19.55.199", "dest_port": 10001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:30:02.644164+0100", "src_ip": "185.242.246.37", "dest_ip": "134.19.55.199", "src_port": 54772, "dest_port": 10001}}');
INSERT INTO alerts VALUES(1289,1773041429.080955982,'{"timestamp": "2026-03-09T08:30:29.080956+0100", "flow_id": 1473603638744755, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 38256, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 63791, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:30:29.080956+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 38256, "dest_port": 53}}');
INSERT INTO alerts VALUES(1290,1773041429.080956935,'{"timestamp": "2026-03-09T08:30:29.080957+0100", "flow_id": 1473608729112440, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 59317, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 10361, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:30:29.080957+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 59317, "dest_port": 53}}');
INSERT INTO alerts VALUES(1291,1773041547.019571065,'{"timestamp": "2026-03-09T08:32:27.019571+0100", "flow_id": 928482546571977, "event_type": "alert", "src_ip": "167.94.146.44", "src_port": 16105, "dest_ip": "134.19.55.199", "dest_port": 36827, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:32:27.019571+0100", "src_ip": "167.94.146.44", "dest_ip": "134.19.55.199", "src_port": 16105, "dest_port": 36827}}');
INSERT INTO alerts VALUES(1292,1773041569.147991895,'{"timestamp": "2026-03-09T08:32:49.147992+0100", "flow_id": 354147553356788, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 54260, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 25529, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:32:49.147992+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 54260, "dest_port": 53}}');
INSERT INTO alerts VALUES(1293,1773041569.147993088,'{"timestamp": "2026-03-09T08:32:49.147993+0100", "flow_id": 354153696427483, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 57311, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 4840, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:32:49.147993+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 57311, "dest_port": 53}}');
INSERT INTO alerts VALUES(1294,1773041569.390640021,'{"timestamp": "2026-03-09T08:32:49.390640+0100", "flow_id": 551887962133970, "event_type": "alert", "src_ip": "45.135.194.48", "src_port": 56662, "dest_ip": "134.19.55.199", "dest_port": 5555, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:32:49.390640+0100", "src_ip": "45.135.194.48", "dest_ip": "134.19.55.199", "src_port": 56662, "dest_port": 5555}}');
INSERT INTO alerts VALUES(1295,1773041580.333933115,'{"timestamp": "2026-03-09T08:33:00.333933+0100", "flow_id": 1152757961442375, "event_type": "alert", "src_ip": "185.242.3.25", "src_port": 40349, "dest_ip": "134.19.55.199", "dest_port": 5678, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400035, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 36", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:33:00.333933+0100", "src_ip": "185.242.3.25", "dest_ip": "134.19.55.199", "src_port": 40349, "dest_port": 5678}}');
INSERT INTO alerts VALUES(1296,1773041638.106466054,'{"timestamp": "2026-03-09T08:33:58.106466+0100", "flow_id": 1864646196032127, "event_type": "alert", "src_ip": "64.62.156.64", "src_port": 36960, "dest_ip": "134.19.55.199", "dest_port": 1883, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:33:58.106466+0100", "src_ip": "64.62.156.64", "dest_ip": "134.19.55.199", "src_port": 36960, "dest_port": 1883}}');
INSERT INTO alerts VALUES(1297,1773041686.388427973,'{"timestamp": "2026-03-09T08:34:46.388428+0100", "flow_id": 1949764176565233, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 50268, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 52692, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "HTTPS"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:34:46.388428+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 50268, "dest_port": 53}}');
INSERT INTO alerts VALUES(1298,1773041686.389169931,'{"timestamp": "2026-03-09T08:34:46.389170+0100", "flow_id": 1952949981435402, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 33827, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 46284, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:34:46.389170+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 33827, "dest_port": 53}}');
INSERT INTO alerts VALUES(1299,1773041686.389169931,'{"timestamp": "2026-03-09T08:34:46.389170+0100", "flow_id": 1952948683778425, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 52531, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2051767, "rev": 1, "signature": "ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)", "category": "Misc activity", "severity": 3, "metadata": {"affected_product": ["Any"], "attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_03_22"], "deployment": ["Perimeter"], "malware_family": ["Cloudflare_Workers"], "performance_impact": ["Low"], "signature_severity": ["Informational"], "tag": ["Cloudflare_Workers"], "updated_at": ["2026_03_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 29566, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "json-update-button.eytvd.workers.dev", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 93, "bytes_toclient": 0, "start": "2026-03-09T08:34:46.389170+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 52531, "dest_port": 53}}');
INSERT INTO alerts VALUES(1300,1773041691.875499964,'{"timestamp": "2026-03-09T08:34:51.875500+0100", "flow_id": 945497053237112, "event_type": "alert", "src_ip": "79.124.62.126", "src_port": 40410, "dest_ip": "134.19.55.199", "dest_port": 3833, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:34:51.875500+0100", "src_ip": "79.124.62.126", "dest_ip": "134.19.55.199", "src_port": 40410, "dest_port": 3833}}');
INSERT INTO alerts VALUES(1301,1773041709.209482909,'{"timestamp": "2026-03-09T08:35:09.209483+0100", "flow_id": 1462672902286222, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 39861, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 44534, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:35:09.209483+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 39861, "dest_port": 53}}');
INSERT INTO alerts VALUES(1302,1773041709.209482909,'{"timestamp": "2026-03-09T08:35:09.209483+0100", "flow_id": 1462676361500815, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 37499, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 56174, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:35:09.209483+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 37499, "dest_port": 53}}');
INSERT INTO alerts VALUES(1303,1773041710.046297074,'{"timestamp": "2026-03-09T08:35:10.046297+0100", "flow_id": 1887694969922905, "event_type": "alert", "src_ip": "176.65.149.194", "src_port": 48498, "dest_ip": "134.19.55.199", "dest_port": 8000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:35:10.046297+0100", "src_ip": "176.65.149.194", "dest_ip": "134.19.55.199", "src_port": 48498, "dest_port": 8000}}');
INSERT INTO alerts VALUES(1304,1773041724.037151098,'{"timestamp": "2026-03-09T08:35:24.037151+0100", "flow_id": 1285464050708860, "event_type": "alert", "src_ip": "193.163.125.207", "src_port": 57112, "dest_ip": "134.19.55.199", "dest_port": 3131, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:35:24.037151+0100", "src_ip": "193.163.125.207", "dest_ip": "134.19.55.199", "src_port": 57112, "dest_port": 3131}}');
INSERT INTO alerts VALUES(1305,1773041751.050868034,'{"timestamp": "2026-03-09T08:35:51.050868+0100", "flow_id": 2188803658509975, "event_type": "alert", "src_ip": "36.73.34.51", "src_port": 26359, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:35:51.050868+0100", "src_ip": "36.73.34.51", "dest_ip": "134.19.55.199", "src_port": 26359, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1306,1773041754.074333907,'{"timestamp": "2026-03-09T08:35:54.074334+0100", "flow_id": 2188803658509975, "event_type": "alert", "src_ip": "36.73.34.51", "src_port": 26359, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 104, "bytes_toclient": 0, "start": "2026-03-09T08:35:51.050868+0100", "src_ip": "36.73.34.51", "dest_ip": "134.19.55.199", "src_port": 26359, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1307,1773041781.008702039,'{"timestamp": "2026-03-09T08:36:21.008702+0100", "flow_id": 1444753801645690, "event_type": "alert", "src_ip": "193.163.125.217", "src_port": 36869, "dest_ip": "134.19.55.199", "dest_port": 873, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:36:21.008702+0100", "src_ip": "193.163.125.217", "dest_ip": "134.19.55.199", "src_port": 36869, "dest_port": 873}}');
INSERT INTO alerts VALUES(1308,1773041789.644517898,'{"timestamp": "2026-03-09T08:36:29.644518+0100", "flow_id": 1642284708929063, "event_type": "alert", "src_ip": "185.242.226.120", "src_port": 46421, "dest_ip": "134.19.55.199", "dest_port": 443, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:36:29.644518+0100", "src_ip": "185.242.226.120", "dest_ip": "134.19.55.199", "src_port": 46421, "dest_port": 443}}');
INSERT INTO alerts VALUES(1309,1773041840.738924027,'{"timestamp": "2026-03-09T08:37:20.738924+0100", "flow_id": 77433826413497, "event_type": "alert", "src_ip": "187.59.156.8", "src_port": 52374, "dest_ip": "134.19.55.199", "dest_port": 1433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "alert": {"action": "blocked", "gid": 1, "signature_id": 2010935, "rev": 3, "signature": "ET SCAN Suspicious inbound to MSSQL port 1433", "category": "Potentially Bad Traffic", "severity": 2, "metadata": {"confidence": ["Medium"], "created_at": ["2010_07_30"], "signature_severity": ["Informational"], "updated_at": ["2019_07_26"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:37:20.738924+0100", "src_ip": "187.59.156.8", "dest_ip": "134.19.55.199", "src_port": 52374, "dest_port": 1433}}');
INSERT INTO alerts VALUES(1310,1773041843.557881116,'{"timestamp": "2026-03-09T08:37:23.557881+0100", "flow_id": 988709813711380, "event_type": "alert", "src_ip": "66.132.153.159", "src_port": 12852, "dest_ip": "134.19.55.199", "dest_port": 8001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:37:23.557881+0100", "src_ip": "66.132.153.159", "dest_ip": "134.19.55.199", "src_port": 12852, "dest_port": 8001}}');
INSERT INTO alerts VALUES(1311,1773041849.317636014,'{"timestamp": "2026-03-09T08:37:29.317636+0100", "flow_id": 519813834729044, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 32843, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 60001, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:37:29.317636+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 32843, "dest_port": 53}}');
INSERT INTO alerts VALUES(1312,1773041849.317636014,'{"timestamp": "2026-03-09T08:37:29.317636+0100", "flow_id": 519814292959469, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 47223, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 21070, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:37:29.317636+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 47223, "dest_port": 53}}');
INSERT INTO alerts VALUES(1313,1773041869.663781882,'{"timestamp": "2026-03-09T08:37:49.663782+0100", "flow_id": 1443551252729077, "event_type": "alert", "src_ip": "79.124.62.230", "src_port": 57617, "dest_ip": "134.19.55.199", "dest_port": 40797, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400009, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 10", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:37:49.663782+0100", "src_ip": "79.124.62.230", "dest_ip": "134.19.55.199", "src_port": 57617, "dest_port": 40797}}');
INSERT INTO alerts VALUES(1314,1773041890.697881937,'{"timestamp": "2026-03-09T08:38:10.697882+0100", "flow_id": 745584103917643, "event_type": "alert", "src_ip": "193.163.125.214", "src_port": 44911, "dest_ip": "134.19.55.199", "dest_port": 11102, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:38:10.697882+0100", "src_ip": "193.163.125.214", "dest_ip": "134.19.55.199", "src_port": 44911, "dest_port": 11102}}');
INSERT INTO alerts VALUES(1315,1773041903.159667015,'{"timestamp": "2026-03-09T08:38:23.159667+0100", "flow_id": 2093141459241089, "event_type": "alert", "src_ip": "147.185.132.109", "src_port": 56378, "dest_ip": "134.19.55.199", "dest_port": 50995, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:38:23.159667+0100", "src_ip": "147.185.132.109", "dest_ip": "134.19.55.199", "src_port": 56378, "dest_port": 50995}}');
INSERT INTO alerts VALUES(1316,1773041935.367959023,'{"timestamp": "2026-03-09T08:38:55.367959+0100", "flow_id": 2143322829353053, "event_type": "alert", "src_ip": "195.184.76.33", "src_port": 47743, "dest_ip": "134.19.55.199", "dest_port": 5900, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:38:55.367959+0100", "src_ip": "195.184.76.33", "dest_ip": "134.19.55.199", "src_port": 47743, "dest_port": 5900}}');
INSERT INTO alerts VALUES(1317,1773041944.884654046,'{"timestamp": "2026-03-09T08:39:04.884654+0100", "flow_id": 140389167469609, "event_type": "alert", "src_ip": "198.235.24.184", "src_port": 51623, "dest_ip": "134.19.55.199", "dest_port": 7001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:39:04.884654+0100", "src_ip": "198.235.24.184", "dest_ip": "134.19.55.199", "src_port": 51623, "dest_port": 7001}}');
INSERT INTO alerts VALUES(1318,1773041989.39361906,'{"timestamp": "2026-03-09T08:39:49.393619+0100", "flow_id": 1409106990444879, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 54746, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 57162, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:39:49.393619+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 54746, "dest_port": 53}}');
INSERT INTO alerts VALUES(1319,1773041989.393620014,'{"timestamp": "2026-03-09T08:39:49.393620+0100", "flow_id": 1409113922873745, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 43313, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 26432, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:39:49.393620+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 43313, "dest_port": 53}}');
INSERT INTO alerts VALUES(1320,1773042022.447922945,'{"timestamp": "2026-03-09T08:40:22.447923+0100", "flow_id": 1923814906479433, "event_type": "alert", "src_ip": "167.94.138.124", "src_port": 63048, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 290, "bytes_toclient": 0, "start": "2026-03-09T08:40:22.447923+0100", "src_ip": "167.94.138.124", "dest_ip": "134.19.55.199", "src_port": 63048, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1321,1773042027.815105915,'{"timestamp": "2026-03-09T08:40:27.815106+0100", "flow_id": 967582206709219, "event_type": "alert", "src_ip": "195.184.76.217", "src_port": 8856, "dest_ip": "134.19.55.199", "dest_port": 5152, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:40:27.815106+0100", "src_ip": "195.184.76.217", "dest_ip": "134.19.55.199", "src_port": 8856, "dest_port": 5152}}');
INSERT INTO alerts VALUES(1322,1773042037.033541917,'{"timestamp": "2026-03-09T08:40:37.033542+0100", "flow_id": 1551439466746805, "event_type": "alert", "src_ip": "198.235.24.241", "src_port": 49668, "dest_ip": "134.19.55.199", "dest_port": 22, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:40:37.033542+0100", "src_ip": "198.235.24.241", "dest_ip": "134.19.55.199", "src_port": 49668, "dest_port": 22}}');
INSERT INTO alerts VALUES(1323,1773042040.681472063,'{"timestamp": "2026-03-09T08:40:40.681472+0100", "flow_id": 112153510640417, "event_type": "alert", "src_ip": "185.242.226.73", "src_port": 39526, "dest_ip": "134.19.55.199", "dest_port": 8415, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:40:40.681472+0100", "src_ip": "185.242.226.73", "dest_ip": "134.19.55.199", "src_port": 39526, "dest_port": 8415}}');
INSERT INTO alerts VALUES(1324,1773042047.951941014,'{"timestamp": "2026-03-09T08:40:47.951941+0100", "flow_id": 2118232853222727, "event_type": "alert", "src_ip": "66.132.153.126", "src_port": 14947, "dest_ip": "134.19.55.199", "dest_port": 5060, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 290, "bytes_toclient": 0, "start": "2026-03-09T08:40:47.951941+0100", "src_ip": "66.132.153.126", "dest_ip": "134.19.55.199", "src_port": 14947, "dest_port": 5060}}');
INSERT INTO alerts VALUES(1325,1773042089.986219882,'{"timestamp": "2026-03-09T08:41:29.986220+0100", "flow_id": 295136228307071, "event_type": "alert", "src_ip": "167.94.138.143", "src_port": 65088, "dest_ip": "134.19.55.199", "dest_port": 103, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:41:29.986220+0100", "src_ip": "167.94.138.143", "dest_ip": "134.19.55.199", "src_port": 65088, "dest_port": 103}}');
INSERT INTO alerts VALUES(1326,1773042129.571105004,'{"timestamp": "2026-03-09T08:42:09.571105+0100", "flow_id": 482556053660012, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 53881, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 58096, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:42:09.571105+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 53881, "dest_port": 53}}');
INSERT INTO alerts VALUES(1327,1773042129.571105004,'{"timestamp": "2026-03-09T08:42:09.571105+0100", "flow_id": 482552927649351, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 41227, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 58492, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:42:09.571105+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 41227, "dest_port": 53}}');
INSERT INTO alerts VALUES(1328,1773042156.733419895,'{"timestamp": "2026-03-09T08:42:36.733420+0100", "flow_id": 1179692854441837, "event_type": "alert", "src_ip": "193.163.125.182", "src_port": 59675, "dest_ip": "134.19.55.199", "dest_port": 18088, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:42:36.733420+0100", "src_ip": "193.163.125.182", "dest_ip": "134.19.55.199", "src_port": 59675, "dest_port": 18088}}');
INSERT INTO alerts VALUES(1329,1773042159.240394116,'{"timestamp": "2026-03-09T08:42:39.240394+0100", "flow_id": 2158387113004362, "event_type": "alert", "src_ip": "64.62.156.22", "src_port": 42512, "dest_ip": "134.19.55.199", "dest_port": 449, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:42:39.240394+0100", "src_ip": "64.62.156.22", "dest_ip": "134.19.55.199", "src_port": 42512, "dest_port": 449}}');
INSERT INTO alerts VALUES(1330,1773042171.730057001,'{"timestamp": "2026-03-09T08:42:51.730057+0100", "flow_id": 883771892397764, "event_type": "alert", "src_ip": "198.235.24.107", "src_port": 55876, "dest_ip": "134.19.55.199", "dest_port": 2455, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:42:51.730057+0100", "src_ip": "198.235.24.107", "dest_ip": "134.19.55.199", "src_port": 55876, "dest_port": 2455}}');
INSERT INTO alerts VALUES(1331,1773042212.547238112,'{"timestamp": "2026-03-09T08:43:32.547238+0100", "flow_id": 1224471955451713, "event_type": "alert", "src_ip": "205.210.31.104", "src_port": 50191, "dest_ip": "134.19.55.199", "dest_port": 7001, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:43:32.547238+0100", "src_ip": "205.210.31.104", "dest_ip": "134.19.55.199", "src_port": 50191, "dest_port": 7001}}');
INSERT INTO alerts VALUES(1332,1773042222.751460076,'{"timestamp": "2026-03-09T08:43:42.751460+0100", "flow_id": 1820122641263083, "event_type": "alert", "src_ip": "193.163.125.211", "src_port": 39058, "dest_ip": "134.19.55.199", "dest_port": 161, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:43:42.751460+0100", "src_ip": "193.163.125.211", "dest_ip": "134.19.55.199", "src_port": 39058, "dest_port": 161}}');
INSERT INTO alerts VALUES(1333,1773042246.778403044,'{"timestamp": "2026-03-09T08:44:06.778403+0100", "flow_id": 1935841737781191, "event_type": "alert", "src_ip": "167.94.138.150", "src_port": 48238, "dest_ip": "134.19.55.199", "dest_port": 995, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:44:06.778403+0100", "src_ip": "167.94.138.150", "dest_ip": "134.19.55.199", "src_port": 48238, "dest_port": 995}}');
INSERT INTO alerts VALUES(1334,1773042250.458306074,'{"timestamp": "2026-03-09T08:44:10.458306+0100", "flow_id": 842510152697086, "event_type": "alert", "src_ip": "167.94.146.37", "src_port": 1747, "dest_ip": "134.19.55.199", "dest_port": 64442, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:44:10.458306+0100", "src_ip": "167.94.146.37", "dest_ip": "134.19.55.199", "src_port": 1747, "dest_port": 64442}}');
INSERT INTO alerts VALUES(1335,1773042262.25745511,'{"timestamp": "2026-03-09T08:44:22.257455+0100", "flow_id": 1950188763847477, "event_type": "alert", "src_ip": "176.65.134.24", "src_port": 61339, "dest_ip": "134.19.55.199", "dest_port": 25565, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 48, "bytes_toclient": 0, "start": "2026-03-09T08:44:22.257455+0100", "src_ip": "176.65.134.24", "dest_ip": "134.19.55.199", "src_port": 61339, "dest_port": 25565}}');
INSERT INTO alerts VALUES(1336,1773042269.654906988,'{"timestamp": "2026-03-09T08:44:29.654907+0100", "flow_id": 1686906326098828, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 35583, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 9032, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:44:29.654907+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 35583, "dest_port": 53}}');
INSERT INTO alerts VALUES(1337,1773042269.655777932,'{"timestamp": "2026-03-09T08:44:29.655778+0100", "flow_id": 1409172235636125, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 43165, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 38237, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:44:29.655778+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 43165, "dest_port": 53}}');
INSERT INTO alerts VALUES(1338,1773042296.687462092,'{"timestamp": "2026-03-09T08:44:56.687462+0100", "flow_id": 137877183132816, "event_type": "alert", "src_ip": "198.235.24.106", "src_port": 57058, "dest_ip": "134.19.55.199", "dest_port": 4433, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:44:56.687462+0100", "src_ip": "198.235.24.106", "dest_ip": "134.19.55.199", "src_port": 57058, "dest_port": 4433}}');
INSERT INTO alerts VALUES(1339,1773042405.158655882,'{"timestamp": "2026-03-09T08:46:45.158656+0100", "flow_id": 1525850114727887, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 50371, "dest_ip": "134.19.55.199", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:46:45.158656+0100", "src_ip": "204.76.203.56", "dest_ip": "134.19.55.199", "src_port": 50371, "dest_port": 8545}}');
INSERT INTO alerts VALUES(1340,1773042405.158655882,'{"timestamp": "2026-03-09T08:46:45.158656+0100", "flow_id": 1525850114727887, "event_type": "alert", "src_ip": "204.76.203.56", "src_port": 50371, "dest_ip": "134.19.55.199", "dest_port": 8545, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 52, "bytes_toclient": 0, "start": "2026-03-09T08:46:45.158656+0100", "src_ip": "204.76.203.56", "dest_ip": "134.19.55.199", "src_port": 50371, "dest_port": 8545}}');
INSERT INTO alerts VALUES(1341,1773042423.943969965,'{"timestamp": "2026-03-09T08:47:03.943970+0100", "flow_id": 2083998796373407, "event_type": "alert", "src_ip": "80.71.235.16", "src_port": 57031, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.TorIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2520108, "rev": 6187, "signature": "ET TOR Known Tor Exit Node Traffic group 109", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2008_12_01"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["TOR"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:47:03.943970+0100", "src_ip": "80.71.235.16", "dest_ip": "134.19.55.199", "src_port": 57031, "dest_port": 80}}');
INSERT INTO alerts VALUES(1342,1773042423.943969965,'{"timestamp": "2026-03-09T08:47:03.943970+0100", "flow_id": 2083998796373407, "event_type": "alert", "src_ip": "80.71.235.16", "src_port": 57031, "dest_ip": "134.19.55.199", "dest_port": 80, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.TorIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2522108, "rev": 6187, "signature": "ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 109", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2008_12_01"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["TOR"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:47:03.943970+0100", "src_ip": "80.71.235.16", "dest_ip": "134.19.55.199", "src_port": 57031, "dest_port": 80}}');
INSERT INTO alerts VALUES(1343,1773042444.664587975,'{"timestamp": "2026-03-09T08:47:24.664588+0100", "flow_id": 1165534190571927, "event_type": "alert", "src_ip": "64.62.197.51", "src_port": 58934, "dest_ip": "134.19.55.199", "dest_port": 447, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:47:24.664588+0100", "src_ip": "64.62.197.51", "dest_ip": "134.19.55.199", "src_port": 58934, "dest_port": 447}}');
INSERT INTO alerts VALUES(1344,1773042468.023608922,'{"timestamp": "2026-03-09T08:47:48.023609+0100", "flow_id": 1227301994529077, "event_type": "alert", "src_ip": "147.185.132.25", "src_port": 51025, "dest_ip": "134.19.55.199", "dest_port": 24156, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:47:48.023609+0100", "src_ip": "147.185.132.25", "dest_ip": "134.19.55.199", "src_port": 51025, "dest_port": 24156}}');
INSERT INTO alerts VALUES(1345,1773042569.767087936,'{"timestamp": "2026-03-09T08:49:29.767088+0100", "flow_id": 479870072957717, "event_type": "alert", "src_ip": "195.184.76.113", "src_port": 24226, "dest_ip": "134.19.55.199", "dest_port": 52224, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:49:29.767088+0100", "src_ip": "195.184.76.113", "dest_ip": "134.19.55.199", "src_port": 24226, "dest_port": 52224}}');
INSERT INTO alerts VALUES(1346,1773042620.27335,'{"timestamp": "2026-03-09T08:50:20.273350+0100", "flow_id": 1174032551946755, "event_type": "alert", "src_ip": "45.142.154.87", "src_port": 58914, "dest_ip": "134.19.55.199", "dest_port": 3116, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:50:20.273350+0100", "src_ip": "45.142.154.87", "dest_ip": "134.19.55.199", "src_port": 58914, "dest_port": 3116}}');
INSERT INTO alerts VALUES(1347,1773042649.940414906,'{"timestamp": "2026-03-09T08:50:49.940415+0100", "flow_id": 379878525328009, "event_type": "alert", "src_ip": "147.185.132.234", "src_port": 54277, "dest_ip": "134.19.55.199", "dest_port": 5902, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:50:49.940415+0100", "src_ip": "147.185.132.234", "dest_ip": "134.19.55.199", "src_port": 54277, "dest_port": 5902}}');
INSERT INTO alerts VALUES(1348,1773042670.052567959,'{"timestamp": "2026-03-09T08:51:10.052568+0100", "flow_id": 1914628760052713, "event_type": "alert", "src_ip": "192.109.200.157", "src_port": 38152, "dest_ip": "134.19.55.199", "dest_port": 17000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400037, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 38", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:51:10.052568+0100", "src_ip": "192.109.200.157", "dest_ip": "134.19.55.199", "src_port": 38152, "dest_port": 17000}}');
INSERT INTO alerts VALUES(1349,1773042690.918814898,'{"timestamp": "2026-03-09T08:51:30.918815+0100", "flow_id": 568584466531756, "event_type": "alert", "src_ip": "147.185.132.118", "src_port": 57277, "dest_ip": "134.19.55.199", "dest_port": 13946, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 95, "bytes_toclient": 0, "start": "2026-03-09T08:51:30.918815+0100", "src_ip": "147.185.132.118", "dest_ip": "134.19.55.199", "src_port": 57277, "dest_port": 13946}}');
INSERT INTO alerts VALUES(1350,1773042712.448183059,'{"timestamp": "2026-03-09T08:51:52.448183+0100", "flow_id": 236084005265364, "event_type": "alert", "src_ip": "64.62.156.120", "src_port": 47287, "dest_ip": "134.19.55.199", "dest_port": 82, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:51:52.448183+0100", "src_ip": "64.62.156.120", "dest_ip": "134.19.55.199", "src_port": 47287, "dest_port": 82}}');
INSERT INTO alerts VALUES(1351,1773042724.331337929,'{"timestamp": "2026-03-09T08:52:04.331338+0100", "flow_id": 1141611319379402, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "134.19.55.199", "dest_port": 2302, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400051, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 52", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 38, "bytes_toclient": 0, "start": "2026-03-09T08:52:04.331338+0100", "src_ip": "204.76.203.17", "dest_ip": "134.19.55.199", "src_port": 47534, "dest_port": 2302}}');
INSERT INTO alerts VALUES(1352,1773042724.331337929,'{"timestamp": "2026-03-09T08:52:04.331338+0100", "flow_id": 1141611319379402, "event_type": "alert", "src_ip": "204.76.203.17", "src_port": 47534, "dest_ip": "134.19.55.199", "dest_port": 2302, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 38, "bytes_toclient": 0, "start": "2026-03-09T08:52:04.331338+0100", "src_ip": "204.76.203.17", "dest_ip": "134.19.55.199", "src_port": 47534, "dest_port": 2302}}');
INSERT INTO alerts VALUES(1353,1773042750.702008963,'{"timestamp": "2026-03-09T08:52:30.702009+0100", "flow_id": 1889209709611690, "event_type": "alert", "src_ip": "185.242.226.8", "src_port": 57170, "dest_ip": "134.19.55.199", "dest_port": 8884, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:52:30.702009+0100", "src_ip": "185.242.226.8", "dest_ip": "134.19.55.199", "src_port": 57170, "dest_port": 8884}}');
INSERT INTO alerts VALUES(1354,1773042817.742235899,'{"timestamp": "2026-03-09T08:53:37.742236+0100", "flow_id": 373130354764414, "event_type": "alert", "src_ip": "88.210.63.69", "src_port": 55676, "dest_ip": "134.19.55.199", "dest_port": 161, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400011, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 12", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:53:37.742236+0100", "src_ip": "88.210.63.69", "dest_ip": "134.19.55.199", "src_port": 55676, "dest_port": 161}}');
INSERT INTO alerts VALUES(1355,1773042828.405090093,'{"timestamp": "2026-03-09T08:53:48.405090+0100", "flow_id": 1176901866660665, "event_type": "alert", "src_ip": "167.94.146.38", "src_port": 25089, "dest_ip": "134.19.55.199", "dest_port": 64572, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:53:48.405090+0100", "src_ip": "167.94.146.38", "dest_ip": "134.19.55.199", "src_port": 25089, "dest_port": 64572}}');
INSERT INTO alerts VALUES(1356,1773042832.473773003,'{"timestamp": "2026-03-09T08:53:52.473773+0100", "flow_id": 64518599039321, "event_type": "alert", "src_ip": "65.49.1.130", "src_port": 59552, "dest_ip": "134.19.55.199", "dest_port": 83, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:53:52.473773+0100", "src_ip": "65.49.1.130", "dest_ip": "134.19.55.199", "src_port": 59552, "dest_port": 83}}');
INSERT INTO alerts VALUES(1357,1773042839.136137008,'{"timestamp": "2026-03-09T08:53:59.136137+0100", "flow_id": 1992081351126702, "event_type": "alert", "src_ip": "45.142.154.10", "src_port": 58914, "dest_ip": "134.19.55.199", "dest_port": 5601, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400005, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 6", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:53:59.136137+0100", "src_ip": "45.142.154.10", "dest_ip": "134.19.55.199", "src_port": 58914, "dest_port": 5601}}');
INSERT INTO alerts VALUES(1358,1773042858.324991942,'{"timestamp": "2026-03-09T08:54:18.324992+0100", "flow_id": 832883351708325, "event_type": "alert", "src_ip": "64.62.156.161", "src_port": 47034, "dest_ip": "134.19.55.199", "dest_port": 85, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 40, "bytes_toclient": 0, "start": "2026-03-09T08:54:18.324992+0100", "src_ip": "64.62.156.161", "dest_ip": "134.19.55.199", "src_port": 47034, "dest_port": 85}}');
INSERT INTO alerts VALUES(1359,1773042871.674865007,'{"timestamp": "2026-03-09T08:54:31.674865+0100", "flow_id": 2054101616228276, "event_type": "alert", "src_ip": "64.62.197.216", "src_port": 33286, "dest_ip": "134.19.55.199", "dest_port": 427, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "app_proto": "failed", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 62, "bytes_toclient": 0, "start": "2026-03-09T08:54:31.674865+0100", "src_ip": "64.62.197.216", "dest_ip": "134.19.55.199", "src_port": 33286, "dest_port": 427}}');
INSERT INTO alerts VALUES(1360,1773042903.363434076,'{"timestamp": "2026-03-09T08:55:03.363434+0100", "flow_id": 2123888656588155, "event_type": "alert", "src_ip": "176.65.139.38", "src_port": 50000, "dest_ip": "134.19.55.199", "dest_port": 3000, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DROPIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2400032, "rev": 4638, "signature": "ET DROP Spamhaus DROP Listed Traffic Inbound group 33", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Minor"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:55:03.363434+0100", "src_ip": "176.65.139.38", "dest_ip": "134.19.55.199", "src_port": 50000, "dest_port": 3000}}');
INSERT INTO alerts VALUES(1361,1773042935.078912019,'{"timestamp": "2026-03-09T08:55:35.078912+0100", "flow_id": 2027775265247292, "event_type": "alert", "src_ip": "198.235.24.198", "src_port": 55672, "dest_ip": "134.19.55.199", "dest_port": 23856, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 44, "bytes_toclient": 0, "start": "2026-03-09T08:55:35.078912+0100", "src_ip": "198.235.24.198", "dest_ip": "134.19.55.199", "src_port": 55672, "dest_port": 23856}}');
INSERT INTO alerts VALUES(1362,1773042938.748547077,'{"timestamp": "2026-03-09T08:55:38.748547+0100", "flow_id": 681710382443501, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 57620, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 26323, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "A"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:55:38.748547+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 57620, "dest_port": 53}}');
INSERT INTO alerts VALUES(1363,1773042938.748547077,'{"timestamp": "2026-03-09T08:55:38.748547+0100", "flow_id": 681713970456729, "event_type": "alert", "src_ip": "192.168.2.16", "src_port": 49021, "dest_ip": "192.168.2.1", "dest_port": 53, "proto": "UDP", "ip_v": 4, "pkt_src": "wire/pcap", "tx_id": 0, "alert": {"action": "blocked", "gid": 1, "signature_id": 2053281, "rev": 1, "signature": "ET INFO Commonly Actor Abused Online Service Domain (syncthing .net)", "category": "Misc activity", "severity": 3, "metadata": {"attack_target": ["Client_Endpoint"], "confidence": ["High"], "created_at": ["2024_06_06"], "deployment": ["Perimeter"], "signature_severity": ["Informational"], "tag": ["Description_Generated_By_Proofpoint_Nexus"], "updated_at": ["2024_06_06"]}}, "dns": {"version": 3, "type": "request", "tx_id": 0, "id": 58532, "flags": "100", "rd": true, "opcode": 0, "rcode": "NOERROR", "queries": [{"rrname": "relays.syncthing.net", "rrtype": "AAAA"}]}, "app_proto": "dns", "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 77, "bytes_toclient": 0, "start": "2026-03-09T08:55:38.748547+0100", "src_ip": "192.168.2.16", "dest_ip": "192.168.2.1", "src_port": 49021, "dest_port": 53}}');
INSERT INTO alerts VALUES(1364,1773042989.390522956,'{"timestamp": "2026-03-09T08:56:29.390523+0100", "flow_id": 1677287282407222, "event_type": "alert", "src_ip": "91.196.152.39", "src_port": 33478, "dest_ip": "134.19.55.199", "dest_port": 20015, "proto": "TCP", "ip_v": 4, "pkt_src": "wire/pcap", "metadata": {"flowbits": ["ET.Evil", "ET.DshieldIP"]}, "alert": {"action": "blocked", "gid": 1, "signature_id": 2402000, "rev": 7670, "signature": "ET DROP Dshield Block Listed Source group 1", "category": "Misc Attack", "severity": 2, "metadata": {"affected_product": ["Any"], "attack_target": ["Any"], "created_at": ["2010_12_30"], "deployment": ["Perimeter"], "signature_severity": ["Major"], "tag": ["Dshield"], "updated_at": ["2026_03_06"]}}, "direction": "to_server", "flow": {"pkts_toserver": 1, "pkts_toclient": 0, "bytes_toserver": 60, "bytes_toclient": 0, "start": "2026-03-09T08:56:29.390523+0100", "src_ip": "91.196.152.39", "dest_ip": "134.19.55.199", "src_port": 33478, "dest_port": 20015}}');
ANALYZE sqlite_schema;
INSERT INTO sqlite_stat1 VALUES('alerts','alerts_timestamp','359 2');
CREATE INDEX alerts_timestamp ON alerts(timestamp);
COMMIT;
Download (1MB)