<134>Sep 15 00:59:10 deepsecurity CEF:0|Trend Micro|Deep Security Agent|50.0.1409|1000793|MS IIS Index Server File Information and Path Disclosure|6|cn1=36299 cn1Label=Host ID dvc=254.201.147.65 TrendMicroDsTenant=PayGoElectric TrendMicroDsTenantId=24873 dmac=0E:B1:8F:82:89:E5 smac=0E:E6:A0:55:AF:01 TrendMicroDsFrameType=IP src=107.132.33.196 dst=254.201.147.65 in=531 cs3=DF 0 cs3Label=Fragmentation Bits proto=TCP spt=58770 dpt=80 cs2=ACK PSH cs2Label=TCP Flags cnt=1 act=Reset cn3=43 cn3Label=DPI Packet Position cs5=11893 cs5Label=DPI Stream Position  cs1="CAN-2001-0986" cs1Label=DPI Note cs6=8 cs6Label=DPI Flags
{
    "senderhost": "34.205.5.1",
    "serverport": 80,
    "severitylabel": "warning",
    "tags": [
        "TCP Flags:ACK PSH",
        "trend micro_deep security agent_MS IIS Index Server File Information and Path Disclosure",
        "rfc3164",
        "DPI Note:CAN-2001-0986",
        "Fragmentation Bits:DF 0",
        "cef",
        "MS IIS Index Server File Information and Path Disclosure",
        "DPI Flags:8",
        "DPI Stream Position :11893",
        "trend micro_deep security agent"
    ],
    "productids": [
        30
    ],
    "severitycode": 4,
    "sourceinfo": "unknown",
    "message": "<134>Sep 15 00:59:10 deepsecurity CEF:0|Trend Micro|Deep Security Agent|50.0.1409|1000793|MS IIS Index Server File Information and Path Disclosure|6|cn1=36299 cn1Label=Host ID dvc=254.201.147.65 TrendMicroDsTenant=PayGoElectric TrendMicroDsTenantId=24873 dmac=0E:B1:8F:82:89:E5 smac=0E:E6:A0:55:AF:01 TrendMicroDsFrameType=IP src=107.132.33.196 dst=254.201.147.65 in=531 cs3=DF 0 cs3Label=Fragmentation Bits proto=TCP spt=58770 dpt=80 cs2=ACK PSH cs2Label=TCP Flags cnt=1 act=Reset cn3=43 cn3Label=DPI Packet Position cs5=11893 cs5Label=DPI Stream Position  cs1=\"CAN-2001-0986\" cs1Label=DPI Note cs6=8 cs6Label=DPI Flags",
    "localstarttime": "Sep 15 00:59:10",
    "sensitivity": "normal",
    "localhostname": "deepsecurity",
    "priority": 134,
    "facilitylabel": "local0",
    "messagetype": "MS IIS Index Server File Information and Path Disclosure",
    "servermac": "0EB18F8289E5",
    "clientmac": "0EE6A055AF01",
    "clientport": 58770,
    "vendorcode": "1000793",
    "action": "Reset",
    "protocol": 6,
    "facilitycode": 16,
    "serverbytes": 531,
    "streamName": "trend micro_deep security agent",
    "clientIP": "107.132.33.196",
    "serverIP": "254.201.147.65"
}