[
    {
        "@timestamp": "2011-11-04T19:44:35.879Z",
        "event.category": [
            "intrusion_detection"
        ],
        "event.dataset": "zeek.notice",
        "event.kind": "alert",
        "event.module": "zeek",
        "event.type": [
            "allowed",
            "info"
        ],
        "fileset.name": "notice",
        "input.type": "log",
        "log.offset": 0,
        "related.ip": [
            "172.16.238.1"
        ],
        "rule.description": "172.16.238.1 appears to be guessing SSH passwords (seen in 30 connections).",
        "rule.name": "SSH::Password_Guessing",
        "service.type": "zeek",
        "source.address": "172.16.238.1",
        "source.ip": "172.16.238.1",
        "tags": [
            "zeek.notice"
        ],
        "zeek.notice.dropped": false,
        "zeek.notice.msg": "172.16.238.1 appears to be guessing SSH passwords (seen in 30 connections).",
        "zeek.notice.note": "SSH::Password_Guessing",
        "zeek.notice.peer_descr": "bro",
        "zeek.notice.sub": "Sampled servers:  172.16.238.136, 172.16.238.136, 172.16.238.136, 172.16.238.136, 172.16.238.136",
        "zeek.notice.suppress_for": 3600
    },
    {
        "@timestamp": "2019-02-28T22:36:28.426Z",
        "destination.address": "207.154.238.205",
        "destination.as.number": 14061,
        "destination.as.organization.name": "DigitalOcean, LLC",
        "destination.geo.city_name": "Frankfurt am Main",
        "destination.geo.continent_name": "Europe",
        "destination.geo.country_iso_code": "DE",
        "destination.geo.country_name": "Germany",
        "destination.geo.location.lat": 50.1188,
        "destination.geo.location.lon": 8.6843,
        "destination.geo.region_iso_code": "DE-HE",
        "destination.geo.region_name": "Hesse",
        "destination.ip": "207.154.238.205",
        "event.category": [
            "intrusion_detection"
        ],
        "event.dataset": "zeek.notice",
        "event.kind": "alert",
        "event.module": "zeek",
        "event.type": [
            "allowed",
            "info"
        ],
        "fileset.name": "notice",
        "input.type": "log",
        "log.offset": 357,
        "network.direction": "external",
        "related.ip": [
            "207.154.238.205",
            "8.42.77.171"
        ],
        "rule.description": "8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s",
        "rule.name": "Scan::Port_Scan",
        "service.type": "zeek",
        "source.address": "8.42.77.171",
        "source.as.number": 393552,
        "source.as.organization.name": "Longmont Power & Communications",
        "source.geo.city_name": "Longmont",
        "source.geo.continent_name": "North America",
        "source.geo.country_iso_code": "US",
        "source.geo.country_name": "United States",
        "source.geo.location.lat": 40.1559,
        "source.geo.location.lon": -105.1624,
        "source.geo.region_iso_code": "US-CO",
        "source.geo.region_name": "Colorado",
        "source.ip": "8.42.77.171",
        "tags": [
            "zeek.notice"
        ],
        "zeek.notice.dropped": false,
        "zeek.notice.msg": "8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s",
        "zeek.notice.note": "Scan::Port_Scan",
        "zeek.notice.peer_descr": "bro",
        "zeek.notice.sub": "remote",
        "zeek.notice.suppress_for": 3600
    }
]