<131>Jul 26 18:51:01 oak-stw-prd1.acme.net Stealthwatch[24863]: CEF:0|Cisco|Stealthwatch|7.5.0|Notification:45|Data Exfiltration|4|msg=Indicates that an abnormal amount of data has been transferred to inside or outside hosts.:Observed 199.11k points. Expected 0 points, tolerance of 95 allows up to 32k points. dst=226.105.73.126 src=250.200.111.227 start=2024-07-26T13:40:00Z end= externalId=8D-1K6V-DICY-SF0D-E cs3=Kedzie,Users cs3Label=SourceHostGroups cs4= cs4Label=TargetHostGroups cs5=https://10.0.1.176/lc-landing-page/smc.html#/host/250.200.111.227 cs5Label=Source_URL cs6=https://10.0.1.176/lc-landing-page/smc.html#/host/226.105.73.126 cs6Label=Target_URL dpt= proto= dvchost=oak-stw-prd2 dvc=10.0.1.175 dvcpid=301 deviceExternalId=oak-stw-prd2 cs2= / / / cs2Label=SGTIdAndSGTName spt= destinationTranslatedAddress= destinationTranslatedPort= sourceTranslatedAddress= sourceTranslatedPort=
This is a syslog message from a product called cisco_stealthwatch by cisco_stealthwatch. The following fields were extracted from the message:
clientIP: 250.200.111.227
facilityCode: 16
facilityLabel: local0
fieldExtractorName: cef
localHostname: oak-stw-prd1.achn.net
localStartTime: Jul 26 18:51:01
messageType: Data Exfiltration
pid: 24863
priority: 131
program: Stealthwatch
senderHost: 10.0.1.176
sensitivity: normal
serverIP: 226.105.73.126
severityCode: 6
severityLabel: informational
sourceInfo: unknown
streamName: cisco_stealthwatch
tags: ['deviceExternalId:oak-stw-prd2', 'Data Exfiltration', 'cisco_stealthwatch_Data Exfiltration', 'rfc3164', 'Source_URL:https://10.0.1.176/lc-landing-page/smc.html#/host/10.2.75.198', 'cef', 'SourceHostGroups:Kedzie,Users', 'Target_URL:https://10.0.1.176/lc-landing-page/smc.html#/host/0.0.0.0', 'cisco_stealthwatch', 'SGTIdAndSGTName: / / /']
vendorCode: Notification:45