Daily reports Postilion

Alarms - A05W063 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W063

Alarms - A05L020 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05L020

Alarms - A05W067 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Environmental Awareness - Suspicious Behaviour - Account 2 0.0.0.0 A05W067
Lockout (1 events)
Environmental Awareness - Suspicious Behaviour - Account 2 0.0.0.0 A05W067
Lockout (1 events)
Environmental Awareness - Suspicious Behaviour - Account 2 0.0.0.0 A05W067
Lockout (1 events)
Environmental Awareness - Suspicious Behaviour - Account 2 0.0.0.0 A05W067
Lockout (1 events)

Alarms - A05W068 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W068

Alarms - A05W069 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Cisco ACS 1 A05W069 0.0.0.0
(10 events)
Delivery & Attack - Bruteforce Authentication - Multiple 3 A05W069 I05L001
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - SSH (1 events) 1 A05W069 I05L001
Delivery & Attack - Bruteforce Authentication - Multiple 3 A05W069 A05L017
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - Multiple 1 A05W069 A05L016
login failures - HIDS reported (1 events)

Alarms - A05W070 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W070

Alarms - A05L015 from: 2018-12-10 to: 2018-12-10

User: admin / 2018-12-11 07:18:01 Page 1 / 8

 Daily reports Postilion

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Multiple 1 A05L015 A05L015
login failures - HIDS reported (1 events)
Delivery & Attack - Bruteforce Authentication - Multiple 3 A05W069 A05L015
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - Linux/Unix 3 A05W069 A05L015
(1144 events)
Delivery & Attack - Bruteforce Authentication - SSH (2 events) 1 A05W069 A05L015
Delivery & Attack - Bruteforce Authentication - SSH (1116 events) 2 A05W069 A05L015

Alarms - A05L016 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Multiple 3 0.0.0.0 A05L016
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - Multiple 1 A05W069 A05L016
login failures - HIDS reported (1 events)
Delivery & Attack - Bruteforce Authentication - SSH (1116 events) 2 A05W069 A05L016
Delivery & Attack - Bruteforce Authentication - Linux/Unix 3 0.0.0.0 A05L016
(1143 events)
Delivery & Attack - Bruteforce Authentication - SSH (2 events) 1 A05W069 A05L016

Alarms - A05L017 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Multiple 3 A05W069 A05L017
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - Multiple 1 A05L017 A05L017
login failures - HIDS reported (1 events)
Delivery & Attack - Bruteforce Authentication - SSH (1 events) 1 A05W069 A05L017
Delivery & Attack - Bruteforce Authentication - Multiple 1 A05W069 A05L017
login failures - HIDS reported (74 events)
Delivery & Attack - Bruteforce Authentication - SSH (1 events) 1 A05W069 A05L017

Alarms - A05L019 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05L019

Alarms - a03l020 from: 2018-12-10 to: 2018-12-10

No Alarms Found for a03l020

Alarms - A05W065 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W065

User: admin / 2018-12-11 07:18:01 Page 2 / 8

 Daily reports Postilion

Alarms - I05W002 from: 2018-12-10 to: 2018-12-10

No Alarms Found for I05W002

Alarms - I05L001 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Multiple 3 A05W069 I05L001
login failures - HIDS reported (187 events)
Delivery & Attack - Bruteforce Authentication - SSH (1 events) 1 A05W069 I05L001

Alarms - I05L002 from: 2018-12-10 to: 2018-12-10

No Alarms Found for I05L002

Alarms - I05L000 from: 2018-12-10 to: 2018-12-10

No Alarms Found for I05L000

Alarms - I05W003 from: 2018-12-10 to: 2018-12-10

No Alarms Found for I05W003

Alarms - A01W031 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A01W031

Alarms - A01W024 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A01W024

Alarms - A00W195 from: 2018-12-10 to: 2018-12-10

Alarm Risk Source Destination

Delivery & Attack - Bruteforce Authentication - Cisco ACS 2 A00W195 0.0.0.0
(90 events)
Delivery & Attack - Bruteforce Authentication - Cisco ACS 2 A00W195 A03L012
(90 events)
Delivery & Attack - Bruteforce Authentication - Cisco ACS 1 A00W195 0.0.0.0
(6 events)
Delivery & Attack - Bruteforce Authentication - Cisco ACS 1 A00W195 A03L012
(6 events)
Delivery & Attack - Bruteforce Authentication - Cisco ACS 1 A00W195 A03L012
(6 events)

User: admin / 2018-12-11 07:18:01 Page 3 / 8

 Daily reports Postilion

Alarms - I05W001 from: 2018-12-10 to: 2018-12-10

No Alarms Found for I05W001

Alarms - A05W060 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W060

Alarms - A05W061 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W061

Alarms - A05W062 from: 2018-12-10 to: 2018-12-10

No Alarms Found for A05W062

Alarm events - Alarm events. Last 25 Events: from: 2018-12-10 to: 2018-12-10

Event Name Date GMT+2:00 Source Destination Risk

AlienVault HIDS: SSH insecure connection
2018-12-10 23:56:32 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:49:45 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:49:22 192.168.116.11 I05L002
attempt (scan).
directive_event: AV Bruteforce attack, login
2018-12-10 23:45:29 A05W069 0.0.0.0
authentication attack against 10.20.20.17
AlienVault HIDS: SSH insecure connection
2018-12-10 23:39:28 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:37:31 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:30:12 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:23:35 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:21:08 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:16:10 192.168.116.11 I05L002
attempt (scan).

User: admin / 2018-12-11 07:18:01 Page 4 / 8

 Daily reports Postilion

AlienVault HIDS: SSH insecure connection

2018-12-10 23:11:01 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:03:09 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 23:03:08 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:52:32 192.168.116.11 I05L002
attempt (scan).
directive_event: AV Bruteforce attack, login
2018-12-10 22:51:32 A00W195 0.0.0.0
authentication attack against 192.168.179.10
directive_event: AV Bruteforce attack, login
2018-12-10 22:51:32 A00W195 A03L012:49
authentication attack against 192.168.179.10
directive_event: AV Bruteforce attack, login
2018-12-10 22:51:30 A00W195 0.0.0.0
authentication attack against 192.168.179.10
directive_event: AV Bruteforce attack, login
2018-12-10 22:51:30 A00W195 A03L012:49
authentication attack against 192.168.179.10
AlienVault HIDS: SSH insecure connection
2018-12-10 22:50:20 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:40:22 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:40:21 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:36:06 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:25:14 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:18:41 192.168.116.11 I05L002
attempt (scan).
AlienVault HIDS: SSH insecure connection
2018-12-10 22:18:40 192.168.116.11 I05L002
attempt (scan).

Logins - Logins. Last 25 Events: from: 2018-12-10 to: 2018-12-10

Date
Event Name Device IP Username Source Dest.
GMT+2:00
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.

User: admin / 2018-12-11 07:18:01 Page 5 / 8

 Daily reports Postilion

AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.
AlienVault HIDS:
2018-12-10
Successful login during 197.97.220.165 Realtime.Service A05W062 A05W062
23:59:48
non-business hours.

Cleartext - Cleartext. Last 25 Events: from: 2018-12-10 to: 2018-12-10

User: admin / 2018-12-11 07:18:01 Page 6 / 8

 Daily reports Postilion

Date
Event Name OTX Source Dest. Risk
GMT+2:00
AlienVault HIDS: Windows Cleartext Logon with Network 2018-12-10
A05W065 A05W065
Access. 15:19:42
AlienVault HIDS: Windows Cleartext Logon with Network 2018-12-10
A05W065 A05W065
Access. 15:19:29

FTP Failed Logons - FTP Failed Logons. Last 25 Events: from: 2018-12-10 to: 2018-12-10

No data available

PCI - Protect Stored Data - Database Succesful Logins. Last 25 Events: from: 2018-12-10 to: 2018-12-10

Event Name Date GMT+2:00 Source Destination Risk

AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:55 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:55 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:55 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:55 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:58:12 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.

User: admin / 2018-12-11 07:18:01 Page 7 / 8

 Daily reports Postilion

AlienVault HIDS: MS SQL Server Logon

2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:57:28 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:53:34 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:53:34 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:53:34 I05W001 I05W001
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:53:34 A05W062 A05W062
Success.
AlienVault HIDS: MS SQL Server Logon
2018-12-10 17:53:34 A05W062 A05W062
Success.

Custom Security Events - Windows User Logons. Last 25 Events: from: 2018-12-10 to: 2018-12-10

No data available

User: admin / 2018-12-11 07:18:01 Page 8 / 8