<131>Jul 26 18:51:01 oak-stw-prd1.acme.net Stealthwatch[24863]: CEF:0|Cisco|Stealthwatch|7.5.0|Notification:45|Data Exfiltration|4|msg=Indicates that an abnormal amount of data has been transferred to inside or outside hosts.:Observed 199.11k points. Expected 0 points, tolerance of 95 allows up to 32k points. dst=226.105.73.126 src=250.200.111.227 start=2024-07-26T13:40:00Z end= externalId=8D-1K6V-DICY-SF0D-E cs3=Kedzie,Users cs3Label=SourceHostGroups cs4= cs4Label=TargetHostGroups cs5=https://10.0.1.176/lc-landing-page/smc.html#/host/250.200.111.227 cs5Label=Source_URL cs6=https://10.0.1.176/lc-landing-page/smc.html#/host/226.105.73.126 cs6Label=Target_URL dpt= proto= dvchost=oak-stw-prd2 dvc=10.0.1.175 dvcpid=301 deviceExternalId=oak-stw-prd2 cs2= / / / cs2Label=SGTIdAndSGTName spt= destinationTranslatedAddress= destinationTranslatedPort= sourceTranslatedAddress= sourceTranslatedPort=
{
    "clientIP": "250.200.111.227",
    "facilityCode": 16,
    "facilityLabel": "local0",
    "fieldExtractorName": "cef",
    "localHostname": "oak-stw-prd1.achn.net",
    "localStartTime": "Jul 26 18:51:01",
    "message": "<131>Jul 26 18:51:01 oak-stw-prd1.acme.net Stealthwatch[24863]: CEF:0|Cisco|Stealthwatch|7.5.0|Notification:45|Data Exfiltration|4|msg=Indicates that an abnormal amount of data has been transferred to inside or outside hosts.:Observed 199.11k points. Expected 0 points, tolerance of 95 allows up to 32k points. dst=226.105.73.126 src=250.200.111.227 start=2024-07-26T13:40:00Z end= externalId=8D-1K6V-DICY-SF0D-E cs3=Kedzie,Users cs3Label=SourceHostGroups cs4= cs4Label=TargetHostGroups cs5=https://10.0.1.176/lc-landing-page/smc.html#/host/250.200.111.227 cs5Label=Source_URL cs6=https://10.0.1.176/lc-landing-page/smc.html#/host/226.105.73.126 cs6Label=Target_URL dpt= proto= dvchost=oak-stw-prd2 dvc=10.0.1.175 dvcpid=301 deviceExternalId=oak-stw-prd2 cs2= / / / cs2Label=SGTIdAndSGTName spt= destinationTranslatedAddress= destinationTranslatedPort= sourceTranslatedAddress= sourceTranslatedPort=",
    "messageType": "Data Exfiltration",
    "pid": 24863,
    "priority": 131,
    "program": "Stealthwatch",
    "senderHost": "10.0.1.176",
    "sensitivity": "normal",
    "serverIP": "226.105.73.126",
    "severityCode": 6,
    "severityLabel": "informational",
    "sourceInfo": "unknown",
    "streamName": "cisco_stealthwatch",
    "tags": [
        "deviceExternalId:oak-stw-prd2",
        "Data Exfiltration",
        "cisco_stealthwatch_Data Exfiltration",
        "rfc3164",
        "Source_URL:https://10.0.1.176/lc-landing-page/smc.html#/host/10.2.75.198",
        "cef",
        "SourceHostGroups:Kedzie,Users",
        "Target_URL:https://10.0.1.176/lc-landing-page/smc.html#/host/0.0.0.0",
        "cisco_stealthwatch",
        "SGTIdAndSGTName: / / /"
    ],
    "vendorCode": "Notification:45"
}