Claroty CTD

{
    "@timestamp": "2023-08-13T01:00:00.000Z",
    "agent": {
        "ephemeral_id": "dd0f88ed-3643-4c24-b2e5-b6ac693c12ea",
        "id": "4c43ff7a-b186-4386-8f6c-ccea4bb3beb3",
        "name": "elastic-agent-74704",
        "type": "filebeat",
        "version": "8.19.2"
    },
    "claroty_ctd": {
        "event": {
            "busy": {
                "dm": {
                    "a_value": 0.77,
                    "value": 0.66
                },
                "fd": 0.11,
                "sda": {
                    "a_value": 0.33,
                    "b_value": 0.44,
                    "value": 0.22
                },
                "sr": 0.55
            },
            "capsaver": {
                "folder_cleanup": true
            },
            "class_id": "HealthCheck",
            "conclude_time": 50,
            "cpu": 12.21,
            "ctrl_site": 48,
            "dissection": {
                "coverage": 44,
                "efficiency": {
                    "dcerpc": 4.2345,
                    "factory_talk_rna": 6.2345,
                    "ge_ifix": 15.2345,
                    "http": 11.2345,
                    "jrmi": 14.2345,
                    "ldap": 13.2345,
                    "llc": 16.2345,
                    "matrikon_nopc": 17.2345,
                    "modbus": 2.2345,
                    "rdp": 9.2345,
                    "smb": 3.2345,
                    "ssh": 10.2345,
                    "ssl": 7.2345,
                    "tcp_http": 12.2345,
                    "vnc": 18.2345,
                    "vrrp_protocol_matcher": 8.2345,
                    "zabbix": 5.2345
                }
            },
            "dissector_ng_packet_drops": 35,
            "dropped_entities": 51,
            "exceptions": 31,
            "full_output_packet_drops": 34,
            "input_packet_drops": 32,
            "loop_call_duration": {
                "baseline_tracker_wrker_handle_network_statistics": 1.2345,
                "cloud_client_wrkr_base_run_cloud_connected": 22.2345,
                "poll_objects": 21.2345
            },
            "memory": 13.31,
            "message": "Successfully ran health monitoring",
            "mysql_query": 19.2345,
            "name": "Health",
            "output_packet_drops": 33,
            "postgres_query": 20.2345,
            "psql_idle": {
                "in_transaction_sessions": 53,
                "sessions": 52
            },
            "queue": {
                "baseline_tracker": 1,
                "bridge": 2,
                "central_bridge": 3,
                "concluding": 4,
                "diode_feeder": 5,
                "dissector": {
                    "a_value": 7,
                    "ng": 8,
                    "value": 6
                },
                "indicator_service": 9,
                "leecher": 10,
                "monitor": 11,
                "network_statistics": 12,
                "packets": {
                    "count": 13,
                    "errors": 14
                },
                "preprocessing": {
                    "count": 15,
                    "ng": 16
                },
                "priority_processing": 17,
                "processing": {
                    "count": 18,
                    "high": 19
                },
                "purge": 22,
                "statistics_ng": 20,
                "syslog": {
                    "alerts": 23,
                    "events": 24,
                    "insights": 25
                },
                "zordon_updates": 21
            },
            "read_count": {
                "dissector": {
                    "a_value": 27,
                    "count": 26,
                    "ng": 28
                },
                "preprocessing": {
                    "count": 29,
                    "ng": 30
                }
            },
            "real_time": "2023-08-14T01:00:00.000Z",
            "sensor_name": "Sensor-1",
            "service": {
                "docker": "Down",
                "firewalld": "Down",
                "icsranger": "Down",
                "jwthenticator": "Down",
                "mariadb": "Down",
                "netunnel": "Down",
                "postgres": "Down",
                "rabbit_mq": "Down",
                "redis": "Down",
                "watchdog": "Down"
            },
            "severity": 0,
            "site": "Default",
            "sniffer_status": {
                "site": 23.2345
            },
            "tag_artifacts_drops": {
                "dissector_pypy": {
                    "sum": 43,
                    "value": 42
                },
                "preprocessor": {
                    "sum": 37,
                    "value": 36
                },
                "processor": {
                    "sum": 39,
                    "value": 38
                },
                "sniffer": {
                    "sum": 41,
                    "value": 40
                }
            },
            "time": "2023-08-13T01:00:00.000Z",
            "unhandled_events": 49,
            "used": {
                "etc": 17.71,
                "opt_icsranger": 14.41,
                "tmp": 16.61,
                "var": 15.51
            },
            "version": "0",
            "worker": {
                "active": {
                    "executer": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "value": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "authentication": {
                    "api": "Not Available",
                    "last_restart": "21 min, 18 sec"
                },
                "baseline_tracker": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "bridge": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "cacher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "capsaver": {
                    "api": "Not Available",
                    "last_restart": "19 min, 17 sec"
                },
                "cloud": {
                    "agent": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "client": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "concluder": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "configurator": {
                    "nginx": {
                        "api": "Not Available",
                        "last_restart": "19 min, 17 sec"
                    },
                    "value": {
                        "api": "Available",
                        "last_restart": "21 min, 18 sec"
                    }
                },
                "dissector": {
                    "a_value": {
                        "api": "Available",
                        "last_restart": "18 min, 34 sec"
                    },
                    "value": {
                        "api": "Available",
                        "last_restart": "18 min, 34 sec"
                    }
                },
                "enricher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "indicators": {
                    "api": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    },
                    "value": {
                        "api": "Not Available",
                        "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                    }
                },
                "insights": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "known_threats": {
                    "api": "Available",
                    "last_restart": "18 min, 58 sec"
                },
                "leecher": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "mailer": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "mitre": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "notifications": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "preprocessor": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "processor": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "scheduler": {
                    "api": "Available",
                    "last_restart": "21 min, 19 sec"
                },
                "sensor": {
                    "api": "Available",
                    "last_restart": "18 min, 34 sec"
                },
                "sync_manager": {
                    "api": "Not Available",
                    "last_restart": "19316 days, 15 hrs, 56 min, 43 sec"
                },
                "web": {
                    "auth": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    },
                    "nginx": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    },
                    "ranger": {
                        "api": "Not Available",
                        "last_restart": "21 min, 6 sec"
                    },
                    "ws": {
                        "api": "Not Available",
                        "last_restart": "21 min, 1 sec"
                    }
                },
                "workers": {
                    "restart": 47,
                    "stop": 46
                }
            },
            "yara_scanner_test": 45
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.event",
        "namespace": "85446",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "4c43ff7a-b186-4386-8f6c-ccea4bb3beb3",
        "snapshot": false,
        "version": "8.19.2"
    },
    "event": {
        "agent_id_status": "verified",
        "dataset": "claroty_ctd.event",
        "ingested": "2026-07-01T10:47:29Z",
        "kind": "event",
        "original": "<134>1 2023-08-15T01:00:00Z Site syslog-HealthCheck-Default - - - CEF:0|Claroty|CTD|4.10.0|HealthCheck|Health|0|CtdRealTime=Aug 14 2023 01:00:00 CtdTimeGenerated=Aug 13 2023 01:00:00 CtdMessage=Successfully ran health monitoring CtdSite=Default CtdCpu=12.21 CtdMem=13.31 CtdUsedOptIcsranger=14.41 CtdUsedVar=15.51 CtdUsedTmp=16.61 CtdUsedEtc=17.71 CtdBusyFd=0.11 CtdBusySda=0.22 CtdBusySdaA=0.33 CtdBusySdaB=0.44 CtdBusySr=0.55 CtdBusyDm=0.66 CtdBusyDmA=0.77 CtdQuBaselineTracker=1 CtdQuBridge=2 CtdQuCentralBridge=3 CtdQuConcluding=4 CtdQuDiodeFeeder=5 CtdQuDissector=6 CtdQuDissectorA=7 CtdQuDissectorNg=8 CtdQuIndicatorService=9 CtdQuLeecher=10 CtdQuMonitor=11 CtdQuNetworkStatistics=12 CtdQuPackets=13 CtdQuPacketsErrors=14 CtdQuPreprocessing=15 CtdQuPreprocessingNg=16 CtdQuPriorityProcessing=17 CtdQuProcessing=18 CtdQuProcessingHigh=19 CtdQuStatisticsNg=20 CtdQuZordonUpdates=21 CtdQueuePurge=22 CtdQuSyslogAlerts=23 CtdQuSyslogEvents=24 CtdQuSyslogInsights=25 CtdRdDissector=26 CtdRdDissectorA=27 CtdRdDissectorNg=28 CtdRdPreprocessing=29 CtdRdPreprocessingNg=30 CtdSvcMariaDb=Down CtdSvcPostgres=Down CtdSvcRedis=Down CtdSvcRabbitMq=Down CtdSvcIcsranger=Down CtdSvcWatchdog=Down CtdSvcFirewalld=Down CtdSvcNetunnel=Down CtdSvcJwthenticator=Down CtdSvcDocker=Down CtdExceptions=31 CtdInputPacketDrops=32 CtdOutputPacketDrops=33 CtdFullOutputPacketDrops=34 CtdDissectorNgPacketDrops=35 CtdTagArtifactsDropsPreprocessor=36 CtdTagArtifactsDropsPreprocessorSum=37 CtdTagArtifactsDropsProcessor=38 CtdTagArtifactsDropsProcessorSum=39 CtdTagArtifactsDropsSniffer=40 CtdTagArtifactsDropsSnifferSum=41 CtdTagArtifactsDropsDissectorPypy=42 CtdTagArtifactsDropsDissectorPypySum=43 CtdCapsaverFolderCleanup=TRUE CtdDissectionCoverage=44 CtdCapsaverUtilzationTest=N/A CtdYaraScannerTest=45 CtdWrkrWorkersStop=46 CtdWrkrWorkersRestart=47 CtdWrkrActiveExecuter={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrSensor={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdWrkrAuthentication={'api': 'Not Available', 'last_restart': '21 min, 18 sec'} CtdWrkrMailer={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrMitre={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrNotifications={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrProcessor={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrCloudAgent={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrCloudClient={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrScheduler={'api': 'Available', 'last_restart': '21 min, 19 sec'} CtdWrkrknownThreats={'api': 'Available', 'last_restart': '18 min, 58 sec'} CtdWrkrCacher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrInsights={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrActive={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrEnricher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrIndicators={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrIndicatorsApi={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrConcluder={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrPreprocessor={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrLeecher={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrSyncManager={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrBridge={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrWebRanger={'api': 'Not Available', 'last_restart': '21 min, 6 sec'} CtdWrkrWebWs={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrWebAuth={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrWebNginx={'api': 'Not Available', 'last_restart': '21 min, 1 sec'} CtdWrkrConfigurator={'api': 'Available', 'last_restart': '21 min, 18 sec'} CtdWrkrConfiguratorNginx={'api': 'Not Available', 'last_restart': '19 min, 17 sec'} CtdWrkrCapsaver={'api': 'Not Available', 'last_restart': '19 min, 17 sec'} CtdWrkrBaselineTracker={'api': 'Not Available', 'last_restart': '19316 days, 15 hrs, 56 min, 43 sec'} CtdWrkrDissector={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdWrkrDissectorA={'api': 'Available', 'last_restart': '18 min, 34 sec'} CtdSensorName=Sensor-1 CtdCtrlSite=48 CtdLoopCallDurationBaselineTrackerWrkerHandleNetworkStatistics=1.2345 CtdDissectionEfficiencyModbus=2.2345 CtdDissectionEfficiencySmb=3.2345 CtdDissectionEfficiencyDcerpc=4.2345 CtdDissectionEfficiencyZabbix=5.2345 CtdDissectionEfficiencyFactorytalkRna=6.2345 CtdDissectionEfficiencySsl=7.2345 CtdDissectionEfficiencyVrrpProtocolMatcher=8.2345 CtdDissectionEfficiencyRdp=9.2345 CtdDissectionEfficiencySsh=10.2345 CtdDissectionEfficiencyHttp=11.2345 CtdDissectionEfficiencyTcpHttp=12.2345 CtdDissectionEfficiencyLdap=13.2345 CtdDissectionEfficiencyJrmi=14.2345 CtdDissectionEfficiencyGeIfix=15.2345 CtdDissectionEfficiencyLlc=16.2345 CtdDissectionEfficiencyMatrikonNopc=17.2345 CtdDissectionEfficiencyVnc=18.2345 CtdUnhandledEvents=49 CtdConcludeTime=50 CtdMysqlQuery=19.2345 CtdPostgresQuery=20.2345 CtdDroppedEntities=51 CtdPsqlIdleSessions=52 CtdPsqlIdleInTransactionSessions=53 CtdSnifferStatus=N/A CtdLoopCallDurationPollObjects=21.2345 CtdLoopCallDurationCloudClientWrkrBaseRunCloudConnected=22.2345 CtdSnifferStatusCentral=N/A CtdSnifferStatusSite=23.2345"
    },
    "host": {
        "cpu": {
            "usage": 12.21
        }
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "source": {
            "address": "172.19.0.3:36529"
        }
    },
    "message": "Successfully ran health monitoring",
    "observer": {
        "hostname": "Default",
        "product": "CTD",
        "vendor": "Claroty",
        "version": "4.10.0"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-event"
    ]
}

{
    "@timestamp": "2024-07-24T15:09:48.000Z",
    "agent": {
        "ephemeral_id": "d199e337-7b77-42d1-a048-a611dcf19fb1",
        "id": "671d5add-3e0f-4f27-8026-edead5ed2347",
        "name": "elastic-agent-75776",
        "type": "filebeat",
        "version": "8.16.0"
    },
    "claroty_ctd": {
        "asset": {
            "approved": true,
            "asset_types": {
                "name": "eHMI",
                "number": 1
            },
            "class_type": "OT",
            "criticalities": {
                "name": "eLow",
                "value": 0
            },
            "custom_attributes": {
                "asset_id": "1",
                "category": {
                    "description": "sdfas",
                    "id": "1",
                    "name": "Some Asset",
                    "resource_id": "1-1",
                    "site_id": "1"
                },
                "id": "1",
                "resource_id": "1-1",
                "site_id": "1",
                "value": "some value"
            },
            "first_seen": "2023-04-17T07:30:15.000Z",
            "ghost": false,
            "id": "1",
            "insight_names": [
                "Managed PLCs (by Rockwell users)",
                "Privileged Operations (Operated PLCs)"
            ],
            "installed_programs_count": 0,
            "ipv4": "1.128.0.0",
            "last_entity_seen": "2023-04-17T07:36:30.000Z",
            "last_seen": "2023-04-17T07:36:30.000Z",
            "last_updated": "2024-07-24T15:09:48.000Z",
            "name": "1.128.0.0",
            "network": {
                "id": "1",
                "name": "Default",
                "resource_id": "1-1",
                "site_id": "1"
            },
            "network_id": "1",
            "num_alerts": 0,
            "parsed": false,
            "patch_count": 0,
            "protocol": [
                "CIP",
                "ENIP",
                "PCCC",
                "TCP"
            ],
            "purdue_level": 2,
            "resource_id": "1-1",
            "risk_level": 0,
            "site_id": "1",
            "site_name": "site-10-0-11-136",
            "special_hints": {
                "name": "eUnicast",
                "value": 0
            },
            "subnet_id": "1",
            "timestamp": "2023-04-17T07:30:15.000Z",
            "usb_devices_count": 0,
            "valid": true,
            "virtual_zone": {
                "id": "2",
                "name": "HMI: Rockwell"
            }
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.asset",
        "namespace": "80333",
        "type": "logs"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "671d5add-3e0f-4f27-8026-edead5ed2347",
        "snapshot": false,
        "version": "8.16.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "dataset": "claroty_ctd.asset",
        "ingested": "2025-07-08T10:54:46Z",
        "kind": "event",
        "module": "claroty_ctd",
        "original": "{\"active_queries_names\":[],\"active_tasks_names\":[],\"approved\":true,\"asset_type\":1,\"asset_type__\":\"eHMI\",\"children\":[],\"class_type\":\"OT\",\"code_sections\":[],\"criticality\":0,\"criticality__\":\"eLow\",\"custom_attributes\":[{\"asset_id\":1,\"category\":{\"description\":\"sdfas\",\"id\":1,\"name\":\"Some Asset\",\"resource_id\":\"1-1\",\"site_id\":1},\"id\":1,\"resource_id\":\"1-1\",\"site_id\":1,\"value\":\"some value\"}],\"custom_informations\":[],\"default_gateway\":null,\"display_name\":null,\"domain_workgroup\":null,\"edge_id\":null,\"edge_last_run\":null,\"first_seen\":\"2023-04-17T07:30:15+00:00\",\"ghost\":false,\"id\":1,\"insight_names\":[\"Managed PLCs (by Rockwell users)\",\"Privileged Operations (Operated PLCs)\"],\"installed_antivirus\":null,\"installed_programs_count\":0,\"ipv4\":[\"1.128.0.0\"],\"last_entity_seen\":\"2023-04-17T07:36:30+00:00\",\"last_seen\":\"2023-04-17T07:36:30+00:00\",\"last_updated\":\"2024-07-24T15:09:48+00:00\",\"name\":\"1.128.0.0\",\"network\":{\"id\":1,\"name\":\"Default\",\"resource_id\":\"1-1\",\"site_id\":1},\"network_id\":1,\"num_alerts\":0,\"os_architecture\":null,\"os_build\":null,\"os_revision\":null,\"os_service_pack\":null,\"parsed\":false,\"patch_count\":0,\"project_parsed\":null,\"protocol\":[\"CIP\",\"ENIP\",\"PCCC\",\"TCP\"],\"purdue_level\":2,\"resource_id\":\"1-1\",\"risk_level\":0,\"site_id\":1,\"site_name\":\"site-10-0-11-136\",\"special_hint\":0,\"special_hint__\":\"eUnicast\",\"state\":null,\"subnet\":{\"name\":\"1.128.0.0\"},\"subnet_id\":1,\"subnet_type\":0,\"timestamp\":\"2023-04-17T07:30:15+00:00\",\"usb_devices_count\":0,\"valid\":true,\"virtual_zone_id\":2,\"virtual_zone_name\":\"HMI: Rockwell\"}",
        "severity": 0,
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "1",
        "name": "1.128.0.0"
    },
    "input": {
        "type": "cel"
    },
    "network": {
        "name": "Default",
        "protocol": [
            "cip",
            "enip",
            "pccc",
            "tcp"
        ]
    },
    "related": {
        "ip": [
            "1.128.0.0"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-asset"
    ]
}

{
    "@timestamp": "2024-07-09T12:03:12.000Z",
    "agent": {
        "ephemeral_id": "ad519873-6d63-420b-a268-6630b023d6ec",
        "id": "0c3df80a-342b-40f2-a198-c340430b670e",
        "name": "elastic-agent-58160",
        "type": "filebeat",
        "version": "8.16.0"
    },
    "claroty_ctd": {
        "baseline": {
            "approved": true,
            "category": 3,
            "category_access": 1,
            "description": "CIP : Read attribute 'Minor Events Reported' of object FaultLog",
            "destination": {
                "asset_id": "51",
                "entity": {
                    "asset_name": "Chemical_plant",
                    "id": "2",
                    "ipv4": "1.128.0.0",
                    "mac": "00:00:BC:C7:8F:06",
                    "resource_id": "2-1",
                    "virtual_zone_id": "3",
                    "virtual_zone_name": "PLC: Rockwell"
                }
            },
            "frequency": 0,
            "has_values": false,
            "hash": "513826395598251000",
            "id": "1",
            "last_seen": "2023-04-17T07:30:09.000Z",
            "last_updated": "2024-07-09T12:03:12.000Z",
            "protocol": "CIP",
            "resource_id": "1-1",
            "session_state": 3,
            "site_id": "1",
            "source": {
                "asset_id": "1",
                "entity": {
                    "id": "1",
                    "ipv4": "1.128.0.0",
                    "resource_id": "1-1",
                    "virtual_zone": {
                        "id": "2",
                        "name": "HMI: Rockwell"
                    }
                }
            },
            "time": "2023-04-17T07:30:09.000Z",
            "type": 0,
            "valid": true
        }
    },
    "data_stream": {
        "dataset": "claroty_ctd.baseline",
        "namespace": "76003",
        "type": "logs"
    },
    "destination": {
        "ip": "1.128.0.0",
        "mac": "00-00-BC-C7-8F-06"
    },
    "ecs": {
        "version": "8.17.0"
    },
    "elastic_agent": {
        "id": "0c3df80a-342b-40f2-a198-c340430b670e",
        "snapshot": false,
        "version": "8.16.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "network"
        ],
        "dataset": "claroty_ctd.baseline",
        "hash": "513826395598251000",
        "id": "1",
        "ingested": "2025-07-08T10:55:35Z",
        "kind": "event",
        "module": "claroty_ctd",
        "original": "{\"approved\":true,\"category\":3,\"category_access\":1,\"description\":\"CIP : Read attribute 'Minor Events Reported' of object FaultLog\",\"destination_asset_id\":51,\"destination_entity\":{\"asset_name\":\"Chemical_plant\",\"id\":2,\"ipv4\":\"1.128.0.0\",\"mac\":\"00:00:BC:C7:8F:06\",\"resource_id\":\"2-1\",\"virtual_zone_id\":3,\"virtual_zone_name\":\"PLC: Rockwell\"},\"dst_port\":null,\"frequency\":0,\"has_values\":false,\"hash\":513826395598251000,\"id\":1,\"interval\":null,\"last_seen\":\"2023-04-17T07:30:09+00:00\",\"last_updated\":\"2024-07-09T12:03:12+00:00\",\"protocol\":\"CIP\",\"resource_id\":\"1-1\",\"session_state\":3,\"site_id\":1,\"source_asset_id\":1,\"source_entity\":{\"asset_name\":\"1.128.0.0\",\"id\":1,\"ipv4\":\"1.128.0.0\",\"resource_id\":\"1-1\",\"virtual_zone_id\":2,\"virtual_zone_name\":\"HMI: Rockwell\"},\"src_port\":null,\"timestamp\":\"2023-04-17T07:30:09+00:00\",\"transmission\":null,\"type\":0,\"valid\":true}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "CIP : Read attribute 'Minor Events Reported' of object FaultLog",
    "network": {
        "protocol": "cip"
    },
    "related": {
        "hash": [
            "513826395598251000"
        ],
        "ip": [
            "1.128.0.0"
        ]
    },
    "source": {
        "ip": "1.128.0.0"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "claroty_ctd-baseline"
    ]
}