ai-network-llms / datasets /wazuh_logs_20.jsonl
JoeiBanana's picture
Upload batch 6/8
b6cb568 verified
Raw
History Blame Contribute Delete
9.83 kB
{"timestamp": "2025-11-12T12:00:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "004", "name": "EDGE-FW1", "ip": "10.0.0.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948801.958162", "full_log": "System: Service started successfully on EDGE-FW1", "decoder": {"name": "syslog"}, "data": {"message": "service started"}, "location": "/var/log/vpn.log"}
{"timestamp": "2025-11-12T12:04:00.000+0100", "rule": {"level": 5, "description": "OSPF adjacency change", "id": "55100", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948802.740959", "full_log": "%OSPF-5-ADJCHG: Neighbor 10.0.1.10 on GigabitEthernet0/0 from FULL to DOWN", "decoder": {"name": "ospf"}, "data": {"neighbor": "10.0.1.10", "interface": "Gi0/0"}, "location": "/var/log/messages"}
{"timestamp": "2025-11-12T12:07:00.000+0100", "rule": {"level": 3, "description": "ACL matched/denied packet", "id": "40110", "firedtimes": 2, "mail": false}, "agent": {"id": "004", "name": "EDGE-FW1", "ip": "10.0.0.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948803.301830", "full_log": "ACL deny tcp 10.0.2.119 any eq 445", "decoder": {"name": "cisco-acl"}, "data": {"srcip": "10.0.2.119", "dstip": "10.0.1.21", "dstport": "445", "protocol": "tcp"}, "location": "/var/log/cisco/acl.log"}
{"timestamp": "2025-11-12T12:09:00.000+0100", "rule": {"level": 3, "description": "ACL matched/denied packet", "id": "40110", "firedtimes": 3, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948804.303180", "full_log": "ACL deny tcp 10.0.1.57 any eq 3389", "decoder": {"name": "cisco-acl"}, "data": {"srcip": "10.0.1.57", "dstip": "10.0.3.206", "dstport": "3389", "protocol": "tcp"}, "location": "/var/log/httpd/access.log"}
{"timestamp": "2025-11-12T12:13:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948805.493500", "full_log": "System: Service started successfully on ACCESS-SW2", "decoder": {"name": "syslog"}, "data": {"message": "service started"}, "location": "/var/log/auth.log"}
{"timestamp": "2025-11-12T12:16:00.000+0100", "rule": {"level": 7, "description": "OSPF adjacency change", "id": "55100", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948806.657117", "full_log": "%OSPF-5-ADJCHG: Neighbor 10.0.3.181 on GigabitEthernet0/0 from FULL to DOWN", "decoder": {"name": "ospf"}, "data": {"neighbor": "10.0.3.181", "interface": "Gi0/0"}, "location": "/var/log/httpd/access.log"}
{"timestamp": "2025-11-12T12:20:00.000+0100", "rule": {"level": 10, "description": "DNS query", "id": "60350", "firedtimes": 1, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948807.989462", "full_log": "DNS query from 10.0.2.61 for safe.local", "decoder": {"name": "dns"}, "data": {"srcip": "10.0.2.61", "query": "safe.local", "protocol": "udp"}, "location": "/var/log/switch.log"}
{"timestamp": "2025-11-12T12:21:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948808.921248", "full_log": "System: Service started successfully on ACCESS-SW1", "decoder": {"name": "auth"}, "data": {"message": "service started"}, "location": "/var/log/auth.log"}
{"timestamp": "2025-11-12T12:25:00.000+0100", "rule": {"level": 10, "description": "Switch anomaly", "id": "40120", "firedtimes": 1, "mail": false}, "agent": {"id": "001", "name": "CORE-R1", "ip": "10.0.0.1"}, "manager": {"name": "wazuh-manager"}, "id": "1762948809.499874", "full_log": "Switch: Detected ARP flood from 10.0.3.200 on interface Gi0/1 VLAN 30", "decoder": {"name": "switch"}, "data": {"srcip": "10.0.3.200", "interface": "Gi0/1", "vlan": "30"}, "location": "/var/log/dns.log"}
{"timestamp": "2025-11-12T12:28:00.000+0100", "rule": {"level": 10, "description": "Firewall connection", "id": "30001", "firedtimes": 1, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948810.495359", "full_log": "Firewall: Connection from 10.0.3.77 to 203.0.113.85 port 445", "decoder": {"name": "firewall"}, "data": {"srcip": "10.0.3.77", "dstip": "203.0.113.85", "dstport": "445", "protocol": "tcp"}, "location": "/var/log/router.log"}
{"timestamp": "2025-11-12T12:31:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948811.928223", "full_log": "System: Service started successfully on ACCESS-SW2", "decoder": {"name": "auth"}, "data": {"message": "service started"}, "location": "/var/log/dns.log"}
{"timestamp": "2025-11-12T12:33:00.000+0100", "rule": {"level": 7, "description": "Switch anomaly", "id": "40120", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948812.254373", "full_log": "Switch: Detected ARP flood from 10.0.2.107 on interface Gi0/2 VLAN 30", "decoder": {"name": "switch"}, "data": {"srcip": "10.0.2.107", "interface": "Gi0/2", "vlan": "30"}, "location": "/var/log/dns.log"}
{"timestamp": "2025-11-12T12:36:00.000+0100", "rule": {"level": 7, "description": "HTTP access", "id": "60001", "firedtimes": 1, "mail": false}, "agent": {"id": "004", "name": "EDGE-FW1", "ip": "10.0.0.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948813.733447", "full_log": "web server: GET /admin from 192.168.12.216 to 10.0.0.2", "decoder": {"name": "httpd"}, "data": {"srcip": "192.168.12.216", "dstip": "10.0.0.2", "protocol": "http", "url": "/admin"}, "location": "/var/log/cisco/acl.log"}
{"timestamp": "2025-11-12T12:41:00.000+0100", "rule": {"level": 10, "description": "SSH authentication event", "id": "5710", "firedtimes": 3, "mail": false}, "agent": {"id": "005", "name": "BRANCH-RTR1", "ip": "10.0.3.1"}, "manager": {"name": "wazuh-manager"}, "id": "1762948814.144325", "full_log": "sshd[7569]: Failed password for invalid user test from 10.0.2.81 port 37780 ssh2", "decoder": {"name": "sshd"}, "data": {"srcip": "10.0.2.81", "dstip": "10.0.3.1", "dstport": "22", "protocol": "tcp", "user": "test"}, "location": "/var/log/dns.log"}
{"timestamp": "2025-11-12T12:44:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948815.478114", "full_log": "System: Service started successfully on ACCESS-SW2", "decoder": {"name": "auth"}, "data": {"message": "service started"}, "location": "/var/log/messages"}
{"timestamp": "2025-11-12T12:45:00.000+0100", "rule": {"level": 9, "description": "SSH authentication event", "id": "5710", "firedtimes": 10, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948816.379800", "full_log": "sshd[5622]: Failed password for invalid user test from 10.0.2.247 port 61552 ssh2", "decoder": {"name": "sshd"}, "data": {"srcip": "10.0.2.247", "dstip": "10.0.1.2", "dstport": "22", "protocol": "tcp", "user": "test"}, "location": "/var/log/httpd/access.log"}
{"timestamp": "2025-11-12T12:49:00.000+0100", "rule": {"level": 3, "description": "Service event", "id": "1001", "firedtimes": 1, "mail": false}, "agent": {"id": "005", "name": "BRANCH-RTR1", "ip": "10.0.3.1"}, "manager": {"name": "wazuh-manager"}, "id": "1762948817.234023", "full_log": "System: Service started successfully on BRANCH-RTR1", "decoder": {"name": "syslog"}, "data": {"message": "service started"}, "location": "/var/log/httpd/access.log"}
{"timestamp": "2025-11-12T12:53:00.000+0100", "rule": {"level": 7, "description": "SSH authentication event", "id": "5711", "firedtimes": 7, "mail": false}, "agent": {"id": "003", "name": "ACCESS-SW2", "ip": "10.0.2.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948818.623894", "full_log": "sshd[7373]: Failed password for invalid user test from 10.0.3.168 port 41935 ssh2", "decoder": {"name": "sshd"}, "data": {"srcip": "10.0.3.168", "dstip": "10.0.2.2", "dstport": "22", "protocol": "tcp", "user": "test"}, "location": "/var/log/auth.log"}
{"timestamp": "2025-11-12T12:54:00.000+0100", "rule": {"level": 7, "description": "HTTP access", "id": "60001", "firedtimes": 1, "mail": false}, "agent": {"id": "002", "name": "ACCESS-SW1", "ip": "10.0.1.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948819.784545", "full_log": "web server: GET /wp-login.php from 192.168.35.178 to 10.0.1.2", "decoder": {"name": "httpd"}, "data": {"srcip": "192.168.35.178", "dstip": "10.0.1.2", "protocol": "http", "url": "/wp-login.php"}, "location": "/var/log/dns.log"}
{"timestamp": "2025-11-12T12:58:00.000+0100", "rule": {"level": 7, "description": "HTTP access", "id": "60001", "firedtimes": 1, "mail": false}, "agent": {"id": "004", "name": "EDGE-FW1", "ip": "10.0.0.2"}, "manager": {"name": "wazuh-manager"}, "id": "1762948820.447324", "full_log": "web server: GET /index from 192.168.50.210 to 10.0.0.2", "decoder": {"name": "httpd"}, "data": {"srcip": "192.168.50.210", "dstip": "10.0.0.2", "protocol": "http", "url": "/index"}, "location": "/var/log/router.log"}