Prisma Cloud

{
    "@timestamp": "2023-09-06T12:30:41.966Z",
    "agent": {
        "ephemeral_id": "8db82bfd-5a45-438b-915d-0ea4d6dd65d9",
        "id": "8a9f6d90-bc0c-452f-9aee-216d0822ecfc",
        "name": "elastic-agent-54360",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "cloud": {
        "account": {
            "id": "710002259376"
        },
        "provider": "aws",
        "service": {
            "name": "Amazon EC2"
        }
    },
    "data_stream": {
        "dataset": "prisma_cloud.alert",
        "namespace": "90378",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "8a9f6d90-bc0c-452f-9aee-216d0822ecfc",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "prisma_cloud.alert",
        "end": "2023-09-06T12:30:41.966Z",
        "id": "N-3910",
        "ingested": "2025-02-11T03:11:16Z",
        "kind": "alert",
        "original": "{\"alertAdditionalInfo\":{\"scannerVersion\":\"CS_2.0\"},\"alertAttribution\":{\"attributionEventList\":[{\"event\":\"first_event\",\"event_ts\":1694003441966,\"username\":\"alex123\"}],\"resourceCreatedBy\":\"string\",\"resourceCreatedOn\":0},\"alertRules\":[],\"alertTime\":1694003441966,\"firstSeen\":1694003441966,\"history\":[{\"modifiedBy\":\"alex123\",\"modifiedOn\":\"1694003441966\",\"reason\":\"Reason1\",\"status\":\"OPEN\"}],\"id\":\"N-3910\",\"investigateOptions\":{\"alertId\":\"N-3910\"},\"lastSeen\":1694003441966,\"lastUpdated\":1694003441966,\"metadata\":null,\"policy\":{\"complianceMetadata\":[{\"complianceId\":\"qwer345bv\",\"customAssigned\":true,\"policyId\":\"werf435tr\",\"requirementDescription\":\"Description of policy compliance.\",\"requirementId\":\"req-123-xyz\",\"requirementName\":\"rigidity\",\"sectionDescription\":\"Description of section.\",\"sectionId\":\"sect-453-abc\",\"sectionLabel\":\"label-1\",\"standardDescription\":\"Description of standard.\",\"standardId\":\"stand-543-pqr\",\"standardName\":\"Class 1\"}],\"deleted\":false,\"description\":\"This policy identifies AWS EC2 instances that are internet reachable with unrestricted access (0.0.0.0/0). EC2 instances with unrestricted access to the internet may enable bad actors to use brute force on a system to gain unauthorised access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit the access to known hosts, services, or specific entities.\",\"findingTypes\":[],\"labels\":[\"Prisma_Cloud\",\"Attack Path Rule\"],\"lastModifiedBy\":\"template@redlock.io\",\"lastModifiedOn\":1687474999057,\"name\":\"AWS EC2 instance that is internet reachable with unrestricted access (0.0.0.0/0)\",\"policyId\":\"ad23603d-754e-4499-8988-b8017xxxx98\",\"policyType\":\"network\",\"recommendation\":\"The following steps are recommended to restrict unrestricted access from the Internet:\\n1. Visit the Network path Analysis from Source to Destination and review the network path components that allow internet access.\\n2. Identify the network component on which restrictive rules can be implemented.\\n3. Implement the required changes and make sure no other resources have been impacted due to these changes:\\n a) The overly permissive Security Group rules can be made more restrictive.\\n b) Move the instance inside a restrictive subnet if the instance does not need to be publicly accessible.\\n c) Define a NAT rule to restrict traffic coming from the Internet to the respective instance.\",\"remediable\":false,\"remediation\":{\"actions\":[{\"operation\":\"buy\",\"payload\":\"erefwsdf\"}],\"cliScriptTemplate\":\"temp1\",\"description\":\"Description of CLI Script Template.\"},\"severity\":\"high\",\"systemDefault\":true},\"policyId\":\"ad23603d-754e-4499-8988-b801xxx85898\",\"reason\":\"NEW_ALERT\",\"resource\":{\"account\":\"AWS Cloud Account\",\"accountId\":\"710002259376\",\"additionalInfo\":null,\"cloudAccountGroups\":[\"Default Account Group\"],\"cloudServiceName\":\"Amazon EC2\",\"cloudType\":\"aws\",\"data\":null,\"id\":\"i-04578exxxx8100947\",\"name\":\"IS-37133\",\"region\":\"AWS Virginia\",\"regionId\":\"us-east-1\",\"resourceApiName\":\"aws-ec2-describe-instances\",\"resourceConfigJsonAvailable\":false,\"resourceDetailsAvailable\":true,\"resourceTs\":1694003441915,\"resourceType\":\"INSTANCE\",\"rrn\":\"rrn:aws:instance:us-east-1:710000059376:e7ddce5a1ffcb47bxxxxxerf2635a3b4d9da3:i-04578e0008100947\",\"unifiedAssetId\":\"66c543b6261c4d9edxxxxxb42e15f4\",\"url\":\"https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Instances:instanceId=i-0457xxxxx00947\"},\"status\":\"open\"}",
        "start": "2023-09-06T12:30:41.966Z",
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "cel"
    },
    "prisma_cloud": {
        "alert": {
            "additional_info": {
                "scanner_version": "CS_2.0"
            },
            "attribution": {
                "event_list": [
                    {
                        "ts": "2023-09-06T12:30:41.966Z",
                        "username": "alex123",
                        "value": "first_event"
                    }
                ],
                "resource": {
                    "created_by": "string",
                    "created_on": "1970-01-01T00:00:00.000Z"
                }
            },
            "first_seen": "2023-09-06T12:30:41.966Z",
            "history": [
                {
                    "modified_by": "alex123",
                    "modified_on": "2023-09-06T12:30:41.966Z",
                    "reason": "Reason1",
                    "status": "OPEN"
                }
            ],
            "id": "N-3910",
            "last": {
                "seen": "2023-09-06T12:30:41.966Z",
                "updated": "2023-09-06T12:30:41.966Z"
            },
            "policy": {
                "compliance_metadata": [
                    {
                        "compliance_id": "qwer345bv",
                        "custom_assigned": true,
                        "policy_id": "werf435tr",
                        "requirement": {
                            "description": "Description of policy compliance.",
                            "id": "req-123-xyz",
                            "name": "rigidity"
                        },
                        "section": {
                            "description": "Description of section.",
                            "id": "sect-453-abc",
                            "label": "label-1"
                        },
                        "standard": {
                            "description": "Description of standard.",
                            "id": "stand-543-pqr",
                            "name": "Class 1"
                        }
                    }
                ],
                "deleted": false,
                "description": "This policy identifies AWS EC2 instances that are internet reachable with unrestricted access (0.0.0.0/0). EC2 instances with unrestricted access to the internet may enable bad actors to use brute force on a system to gain unauthorised access to the entire network. As a best practice, restrict traffic from unknown IP addresses and limit the access to known hosts, services, or specific entities.",
                "id": "ad23603d-754e-4499-8988-b8017xxxx98",
                "labels": [
                    "Prisma_Cloud",
                    "Attack Path Rule"
                ],
                "last_modified_by": "template@redlock.io",
                "last_modified_on": "2023-06-22T23:03:19.057Z",
                "name": "AWS EC2 instance that is internet reachable with unrestricted access (0.0.0.0/0)",
                "recommendation": "The following steps are recommended to restrict unrestricted access from the Internet:\n1. Visit the Network path Analysis from Source to Destination and review the network path components that allow internet access.\n2. Identify the network component on which restrictive rules can be implemented.\n3. Implement the required changes and make sure no other resources have been impacted due to these changes:\n a) The overly permissive Security Group rules can be made more restrictive.\n b) Move the instance inside a restrictive subnet if the instance does not need to be publicly accessible.\n c) Define a NAT rule to restrict traffic coming from the Internet to the respective instance.",
                "remediable": false,
                "remediation": {
                    "actions": [
                        {
                            "operation": "buy",
                            "payload": "erefwsdf"
                        }
                    ],
                    "cli_script_template": "temp1",
                    "description": "Description of CLI Script Template."
                },
                "severity": "high",
                "system_default": true,
                "type": "network"
            },
            "policy_id": "ad23603d-754e-4499-8988-b801xxx85898",
            "reason": "NEW_ALERT",
            "resource": {
                "account": {
                    "id": "710002259376",
                    "value": "AWS Cloud Account"
                },
                "api_name": "aws-ec2-describe-instances",
                "cloud": {
                    "account": {
                        "groups": [
                            "Default Account Group"
                        ]
                    },
                    "service_name": "Amazon EC2",
                    "type": "aws"
                },
                "config_json_available": false,
                "details_available": true,
                "id": "i-04578exxxx8100947",
                "name": "IS-37133",
                "region": {
                    "id": "us-east-1",
                    "value": "AWS Virginia"
                },
                "rrn": "rrn:aws:instance:us-east-1:710000059376:e7ddce5a1ffcb47bxxxxxerf2635a3b4d9da3:i-04578e0008100947",
                "ts": "2023-09-06T12:30:41.915Z",
                "type": "INSTANCE",
                "unified_asset_id": "66c543b6261c4d9edxxxxxb42e15f4",
                "url": "https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Instances:instanceId=i-0457xxxxx00947"
            },
            "status": "open",
            "time": "2023-09-06T12:30:41.966Z"
        }
    },
    "related": {
        "user": [
            "alex123"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-alert"
    ],
    "url": {
        "domain": "console.aws.amazon.com",
        "fragment": "Instances:instanceId=i-0457xxxxx00947",
        "original": "https://console.aws.amazon.com/ec2/v2/home?region=us-east-1#Instances:instanceId=i-0457xxxxx00947",
        "path": "/ec2/v2/home",
        "query": "region=us-east-1",
        "scheme": "https"
    }
}

{
    "@timestamp": "2023-09-13T08:40:39.068Z",
    "agent": {
        "ephemeral_id": "748799a0-a545-468b-9b86-764414774225",
        "id": "47449736-bd61-40ad-89a6-41d7f7acc093",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "data_stream": {
        "dataset": "prisma_cloud.audit",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "47449736-bd61-40ad-89a6-41d7f7acc093",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "action": "login",
        "agent_id_status": "verified",
        "category": [
            "authentication"
        ],
        "dataset": "prisma_cloud.audit",
        "ingested": "2023-11-27T09:09:44Z",
        "kind": "event",
        "original": "{\"action\":\"'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key.\",\"actionType\":\"LOGIN\",\"ipAddress\":\"81.2.69.192\",\"resourceName\":\"john.user@google.com\",\"resourceType\":\"Login\",\"result\":\"Successful\",\"timestamp\":1694594439068,\"user\":\"john.user@google.com\"}",
        "outcome": "success",
        "type": [
            "info"
        ]
    },
    "host": {
        "ip": [
            "81.2.69.192"
        ]
    },
    "input": {
        "type": "cel"
    },
    "prisma_cloud": {
        "audit": {
            "action": {
                "type": "LOGIN",
                "value": "'john.user@google.com'(with role 'System Admin':'System Admin') logged in via access key."
            },
            "ip_address": "81.2.69.192",
            "resource": {
                "name": "john.user@google.com",
                "type": "Login"
            },
            "result": "Successful",
            "timestamp": "2023-09-13T08:40:39.068Z",
            "user": "john.user@google.com"
        }
    },
    "related": {
        "ip": [
            "81.2.69.192"
        ],
        "user": [
            "john.user",
            "john.user@google.com"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-audit"
    ],
    "user": {
        "domain": "google.com",
        "email": "john.user@google.com",
        "name": "john.user"
    }
}

{
    "@timestamp": "2025-03-31T09:42:30.622Z",
    "agent": {
        "ephemeral_id": "c34501c1-1570-4a32-a35a-657647ca6308",
        "id": "4b33b450-e455-4d8c-948b-3d59e881949b",
        "name": "elastic-agent-82059",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "id": "Non-onboarded cloud accounts"
        },
        "instance": {
            "id": "string",
            "name": "string"
        },
        "machine": {
            "type": "string"
        },
        "provider": [
            "aws"
        ],
        "region": "string"
    },
    "data_stream": {
        "dataset": "prisma_cloud.host",
        "namespace": "10259",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "4b33b450-e455-4d8c-948b-3d59e881949b",
        "snapshot": true,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "dataset": "prisma_cloud.host",
        "id": "DESKTOP-6PQXXMS",
        "ingested": "2025-03-31T09:42:31Z",
        "kind": "event",
        "original": "{\"_id\":\"DESKTOP-6PQXXMS\",\"binaries\":[{\"altered\":true,\"cveCount\":0,\"deps\":[\"string\"],\"fileMode\":0,\"functionLayer\":\"string\",\"md5\":\"string\",\"missingPkg\":true,\"name\":\"string\",\"path\":\"string\",\"pkgRootDir\":\"string\",\"services\":[\"string\"],\"version\":\"string\"}],\"cloudMetadata\":{\"accountID\":\"Non-onboarded cloud accounts\",\"awsExecutionEnv\":\"string\",\"image\":\"string\",\"labels\":[{\"key\":\"string\",\"sourceName\":\"string\",\"sourceType\":[\"namespace\"],\"timestamp\":\"2023-09-08T04:01:49.949Z\",\"value\":\"string\"}],\"name\":\"string\",\"provider\":[\"aws\"],\"region\":\"string\",\"resourceID\":\"string\",\"resourceURL\":\"string\",\"type\":\"string\",\"vmID\":\"string\",\"vmImageID\":\"string\"},\"type\":\"host\",\"hostname\":\"DESKTOP-6PQXXMS\",\"scanTime\":\"2023-08-23T11:48:41.803Z\",\"Secrets\":[],\"osDistro\":\"windows\",\"osDistroVersion\":\"string\",\"osDistroRelease\":\"Windows\",\"distro\":\"Microsoft Windows [Version 10.0.19045.2006]\",\"packageManager\":true,\"packages\":[{\"pkgs\":[{\"binaryIdx\":[0],\"binaryPkgs\":[\"string\"],\"cveCount\":0,\"defaultGem\":true,\"files\":[{\"md5\":\"string\",\"path\":\"string\",\"sha1\":\"string\",\"sha256\":\"string\"}],\"functionLayer\":\"string\",\"goPkg\":true,\"jarIdentifier\":\"string\",\"layerTime\":0,\"license\":\"string\",\"name\":\"string\",\"osPackage\":true,\"path\":\"string\",\"version\":\"string\"}],\"pkgsType\":\"nodejs\"}],\"isARM64\":false,\"packageCorrelationDone\":true,\"redHatNonRPMImage\":false,\"image\":{\"created\":\"0001-01-01T00:00:00Z\",\"entrypoint\":[\"string\"],\"env\":[\"string\"],\"healthcheck\":true,\"id\":\"string\",\"labels\":{},\"layers\":[\"string\"],\"os\":\"string\",\"repoDigest\":[\"string\"],\"repoTags\":[\"string\"],\"user\":\"string\",\"workingDir\":\"string\"},\"allCompliance\":{\"compliance\":[{\"applicableRules\":[\"string\"],\"binaryPkgs\":[\"string\"],\"block\":true,\"cause\":\"string\",\"cri\":true,\"custom\":true,\"cve\":\"string\",\"cvss\":0,\"description\":\"string\",\"discovered\":\"2023-09-08T04:01:49.949Z\",\"exploit\":[\"exploit-db\"],\"fixDate\":0,\"fixLink\":\"string\",\"functionLayer\":\"string\",\"gracePeriodDays\":0,\"id\":0,\"layerTime\":0,\"link\":\"string\",\"packageName\":\"string\",\"packageVersion\":\"string\",\"published\":0,\"riskFactors\":{},\"severity\":\"string\",\"status\":\"string\",\"templates\":[[\"PCI\"]],\"text\":\"string\",\"title\":\"string\",\"twistlock\":true,\"type\":[\"container\"],\"vecStr\":\"string\",\"vulnTagInfos\":[{\"color\":\"string\",\"comment\":\"string\",\"name\":\"string\"}],\"wildfireMalware\":{\"md5\":\"string\",\"path\":\"string\",\"verdict\":\"string\"}}],\"enabled\":\"true\"},\"clusters\":[\"string\"],\"repoTag\":null,\"tags\":[{\"digest\":\"string\",\"id\":\"string\",\"registry\":\"string\",\"repo\":\"string\",\"tag\":\"string\"}],\"trustResult\":{\"hostsStatuses\":[{\"host\":\"string\",\"status\":\"trusted\"}]},\"repoDigests\":[],\"creationTime\":\"0001-01-01T00:00:00Z\",\"pushTime\":\"0001-01-01T00:00:00Z\",\"vulnerabilitiesCount\":0,\"complianceIssuesCount\":4,\"vulnerabilityDistribution\":{\"critical\":0,\"high\":0,\"medium\":0,\"low\":0,\"total\":0},\"complianceDistribution\":{\"critical\":4,\"high\":0,\"medium\":0,\"low\":0,\"total\":4},\"vulnerabilityRiskScore\":0,\"complianceRiskScore\":4000000,\"riskFactors\":{},\"firstScanTime\":\"2023-08-11T06:53:57.456Z\",\"history\":[{\"baseLayer\":true,\"created\":0,\"emptyLayer\":true,\"id\":\"string\",\"instruction\":\"string\",\"sizeBytes\":0,\"tags\":[\"string\"],\"vulnerabilities\":[{\"applicableRules\":[\"string\"],\"binaryPkgs\":[\"string\"],\"block\":true,\"cause\":\"string\",\"cri\":true,\"custom\":true,\"cve\":\"string\",\"cvss\":0,\"description\":\"string\",\"discovered\":\"2023-09-08T04:01:49.950Z\",\"exploit\":[\"exploit-db\"],\"exploits\":[{\"kind\":[\"poc\",\"in-the-wild\"],\"link\":\"string\",\"source\":[\"\",\"exploit-db\"]}],\"fixDate\":0,\"fixLink\":\"string\",\"functionLayer\":\"string\",\"gracePeriodDays\":0,\"id\":0,\"layerTime\":0,\"link\":\"string\",\"packageName\":\"string\",\"packageVersion\":\"string\",\"published\":0,\"riskFactors\":{},\"severity\":\"string\",\"status\":\"string\",\"templates\":[[\"PCI\"]],\"text\":\"string\",\"title\":\"string\",\"twistlock\":true,\"type\":[\"container\"],\"vecStr\":\"string\",\"vulnTagInfos\":[{\"color\":\"string\",\"comment\":\"string\",\"name\":\"string\"}],\"wildfireMalware\":{\"md5\":\"string\",\"path\":\"string\",\"verdict\":\"string\"}}]}],\"hostDevices\":[{\"ip\":\"0.0.0.0\",\"name\":\"string\"}],\"hosts\":{},\"id\":\"string\",\"err\":\"\",\"collections\":[\"All\"],\"instances\":[{\"host\":\"string\",\"image\":\"string\",\"modified\":\"2023-09-08T04:01:49.951Z\",\"registry\":\"string\",\"repo\":\"string\",\"tag\":\"string\"}],\"scanID\":0,\"trustStatus\":\"\",\"externalLabels\":[{\"key\":\"string\",\"sourceName\":\"string\",\"sourceType\":[\"namespace\"],\"timestamp\":\"2023-09-08T04:01:49.949Z\",\"value\":\"string\"}],\"files\":[{\"md5\":\"string\",\"path\":\"string\",\"sha1\":\"string\",\"sha256\":\"string\"}],\"firewallProtection\":{\"enabled\":false,\"supported\":false,\"outOfBandMode\":\"Observation\",\"ports\":[0],\"tlsPorts\":[0],\"unprotectedProcesses\":[{\"port\":0,\"process\":\"string\",\"tls\":true}]},\"applications\":[{\"installedFromPackage\":true,\"knownVulnerabilities\":0,\"layerTime\":0,\"name\":\"string\",\"path\":\"string\",\"service\":true,\"version\":\"string\"}],\"appEmbedded\":false,\"wildFireUsage\":null,\"agentless\":false,\"malwareAnalyzedTime\":\"0001-01-01T00:00:00Z\"}",
        "start": "0001-01-01T00:00:00.000Z",
        "type": [
            "info"
        ]
    },
    "file": {
        "hash": {
            "md5": [
                "string"
            ],
            "sha1": [
                "string"
            ],
            "sha256": [
                "string"
            ]
        },
        "path": [
            "string"
        ]
    },
    "host": {
        "hostname": "DESKTOP-6PQXXMS",
        "ip": [
            "0.0.0.0"
        ],
        "type": "host"
    },
    "input": {
        "type": "udp"
    },
    "log": {
        "source": {
            "address": "172.16.32.3:33428"
        }
    },
    "os": {
        "family": "windows",
        "name": "Windows",
        "version": "string"
    },
    "package": {
        "license": [
            "string"
        ],
        "name": [
            "string"
        ],
        "path": [
            "string"
        ],
        "type": [
            "nodejs"
        ],
        "version": [
            "string"
        ]
    },
    "prisma_cloud": {
        "host": {
            "_id": "DESKTOP-6PQXXMS",
            "agentless": false,
            "all_compliance": {
                "data": {
                    "cve": [
                        "string"
                    ]
                },
                "enabled": true
            },
            "app_embedded": false,
            "applications": [
                {
                    "installed_from_package": true,
                    "known_vulnerabilities": 0,
                    "layer_time": "1970-01-01T00:00:00.000Z",
                    "name": "string",
                    "path": "string",
                    "service": true,
                    "version": "string"
                }
            ],
            "binaries": [
                {
                    "altered": true,
                    "cve_count": 0,
                    "deps": [
                        "string"
                    ],
                    "file_mode": 0,
                    "function_layer": "string",
                    "md5": "string",
                    "missing_pkg": true,
                    "name": "string",
                    "path": "string",
                    "pkg_root_dir": "string",
                    "services": [
                        "string"
                    ],
                    "version": "string"
                }
            ],
            "cloud_metadata": {
                "account_id": "Non-onboarded cloud accounts",
                "aws_execution_env": "string",
                "image": "string",
                "labels": [
                    {
                        "key": "string",
                        "source": {
                            "name": "string",
                            "type": [
                                "namespace"
                            ]
                        },
                        "timestamp": "2023-09-08T04:01:49.949Z",
                        "value": "string"
                    }
                ],
                "name": "string",
                "provider": [
                    "aws"
                ],
                "region": "string",
                "resource": {
                    "id": "string",
                    "url": "string"
                },
                "type": "string",
                "vm": {
                    "id": "string",
                    "image_id": "string"
                }
            },
            "clusters": [
                "string"
            ],
            "collections": [
                "All"
            ],
            "compliance_distribution": {
                "critical": 4,
                "high": 0,
                "low": 0,
                "medium": 0,
                "total": 4
            },
            "compliance_issues": {
                "count": 4
            },
            "compliance_risk_score": 4000000,
            "creation_time": "0001-01-01T00:00:00.000Z",
            "devices": [
                {
                    "ip": "0.0.0.0",
                    "name": "string"
                }
            ],
            "distro": "Microsoft Windows [Version 10.0.19045.2006]",
            "external_labels": [
                {
                    "key": "string",
                    "source": {
                        "name": "string",
                        "type": [
                            "namespace"
                        ]
                    },
                    "timestamp": "2023-09-08T04:01:49.949Z",
                    "value": "string"
                }
            ],
            "files": [
                {
                    "md5": "string",
                    "path": "string",
                    "sha1": "string",
                    "sha256": "string"
                }
            ],
            "firewall_protection": {
                "enabled": false,
                "out_of_band_mode": "Observation",
                "ports": [
                    0
                ],
                "supported": false,
                "tls_ports": [
                    0
                ],
                "unprotected_processes": [
                    {
                        "port": 0,
                        "process": "string",
                        "tls": true
                    }
                ]
            },
            "first_scan_time": "2023-08-11T06:53:57.456Z",
            "history": [
                {
                    "base_layer": true,
                    "created": "1970-01-01T00:00:00.000Z",
                    "empty_layer": true,
                    "id": "string",
                    "instruction": "string",
                    "size_bytes": 0,
                    "tags": [
                        "string"
                    ],
                    "vulnerabilities": {
                        "cve": [
                            "string"
                        ]
                    }
                }
            ],
            "hostname": "DESKTOP-6PQXXMS",
            "id": "string",
            "image": {
                "created": "0001-01-01T00:00:00.000Z",
                "entrypoint": [
                    "string"
                ],
                "env": [
                    "string"
                ],
                "healthcheck": true,
                "id": "string",
                "layers": [
                    "string"
                ],
                "os": "string",
                "repo": {
                    "digest": [
                        "string"
                    ],
                    "tags": [
                        "string"
                    ]
                },
                "user": "string",
                "working_dir": "string"
            },
            "instances": [
                {
                    "host": "string",
                    "image": "string",
                    "modified": "2023-09-08T04:01:49.951Z",
                    "registry": "string",
                    "repo": "string",
                    "tag": "string"
                }
            ],
            "is_arm64": false,
            "malware_analyzed_time": "0001-01-01T00:00:00.000Z",
            "os_distro": {
                "release": "Windows",
                "value": "windows",
                "version": "string"
            },
            "package": {
                "correlation_done": true,
                "manager": true
            },
            "packages": [
                {
                    "pkgs": [
                        {
                            "binary_idx": [
                                0
                            ],
                            "binary_pkgs": [
                                "string"
                            ],
                            "cve_count": 0,
                            "default_gem": true,
                            "files": [
                                {
                                    "md5": "string",
                                    "path": "string",
                                    "sha1": "string",
                                    "sha256": "string"
                                }
                            ],
                            "function_layer": "string",
                            "go_pkg": true,
                            "jar_identifier": "string",
                            "layer_time": "1970-01-01T00:00:00.000Z",
                            "license": "string",
                            "name": "string",
                            "os_package": true,
                            "path": "string",
                            "version": "string"
                        }
                    ],
                    "pkgs_type": "nodejs"
                }
            ],
            "push_time": "0001-01-01T00:00:00.000Z",
            "red_hat_non_rpm_image": false,
            "scan": {
                "time": "2023-08-23T11:48:41.803Z"
            },
            "tags": [
                {
                    "digest": "string",
                    "id": "string",
                    "registry": "string",
                    "repo": "string",
                    "tag": "string"
                }
            ],
            "trust_result": {
                "hosts_statuses": [
                    {
                        "host": "string",
                        "status": "trusted"
                    }
                ]
            },
            "type": "host",
            "vulnerabilities": {
                "count": 0
            },
            "vulnerability": {
                "distribution": {
                    "critical": 0,
                    "high": 0,
                    "low": 0,
                    "medium": 0,
                    "total": 0
                },
                "risk_score": 0
            }
        }
    },
    "related": {
        "hash": [
            "string"
        ],
        "hosts": [
            "string",
            "DESKTOP-6PQXXMS"
        ],
        "ip": [
            "0.0.0.0"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-host"
    ],
    "vulnerability": {
        "id": [
            "string"
        ],
        "severity": [
            "string"
        ]
    }
}

{
    "@timestamp": "2023-11-03T06:37:12.285Z",
    "agent": {
        "ephemeral_id": "3b83c31f-09ab-4ff3-b475-ecc8648c3ef9",
        "id": "f2974986-16b8-49d0-803d-316e0e9f4e94",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.10.1"
    },
    "data_stream": {
        "dataset": "prisma_cloud.host_profile",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "f2974986-16b8-49d0-803d-316e0e9f4e94",
        "snapshot": false,
        "version": "8.10.1"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "host"
        ],
        "created": "2023-08-11T06:53:48.855Z",
        "dataset": "prisma_cloud.host_profile",
        "ingested": "2023-11-03T06:37:13Z",
        "kind": "asset",
        "original": "{\"_id\":\"DESKTOP-6PXXAMS\",\"hash\":1,\"created\":\"2023-08-11T06:53:48.855Z\",\"time\":\"0001-01-01T00:00:00Z\",\"collections\":[\"All\"]}",
        "type": [
            "info"
        ]
    },
    "host": {
        "hostname": "DESKTOP-6PXXAMS"
    },
    "input": {
        "type": "tcp"
    },
    "log": {
        "source": {
            "address": "192.168.243.5:48144"
        }
    },
    "prisma_cloud": {
        "host_profile": {
            "_id": "DESKTOP-6PXXAMS",
            "collections": [
                "All"
            ],
            "created": "2023-08-11T06:53:48.855Z",
            "hash": "1",
            "time": "0001-01-01T00:00:00.000Z"
        }
    },
    "related": {
        "hash": [
            "1"
        ],
        "hosts": [
            "DESKTOP-6PXXAMS"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-host_profile"
    ]
}

{
    "@timestamp": "2023-09-19T07:15:31.899Z",
    "agent": {
        "ephemeral_id": "2bcef8c2-6ed9-42d7-9dac-cba99dc89ea3",
        "id": "7bcfbb54-8fe1-48a5-85cd-23794e360014",
        "name": "elastic-agent-61906",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "cloud": {
        "account": {
            "id": [
                "123abc",
                "abdcsfData"
            ]
        },
        "provider": [
            "alibaba",
            "oci"
        ],
        "region": "string"
    },
    "container": {
        "id": "container123",
        "image": {
            "name": [
                "docker.io/library/nginx:latest",
                "string"
            ]
        },
        "name": [
            "nginx",
            "Example Container"
        ]
    },
    "data_stream": {
        "dataset": "prisma_cloud.incident_audit",
        "namespace": "20978",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "7bcfbb54-8fe1-48a5-85cd-23794e360014",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "malware"
        ],
        "dataset": "prisma_cloud.incident_audit",
        "id": "651c46b145d15228585exxxx",
        "ingested": "2025-05-23T11:09:31Z",
        "kind": "event",
        "original": "{\"_id\":\"651c46b145d15228585exxxx\",\"accountID\":\"123abc\",\"acknowledged\":false,\"app\":\"string\",\"appID\":\"string\",\"audits\":[{\"_id\":\"651c46b145d15228585exxxx\",\"accountID\":\"abdcsfData\",\"app\":\"string\",\"appID\":\"abc123\",\"attackTechniques\":[\"exploitationForPrivilegeEscalation\"],\"attackType\":\"cloudMetadataProbing\",\"cluster\":\"string\",\"collections\":[\"string\"],\"command\":\"string\",\"container\":true,\"containerId\":\"5490e85a1a0c1c9f9c74591a9d3fcbf61beb84a952f14a17277be5fcf00xxxxx\",\"containerName\":\"nginx\",\"count\":0,\"country\":\"string\",\"domain\":\"string\",\"effect\":[\"block\",\"prevent\"],\"err\":\"string\",\"filepath\":\"string\",\"fqdn\":\"audits-fqdn-hostname\",\"function\":\"string\",\"functionID\":\"string\",\"hostname\":\"gke-tp-cluster-tp-pool1-9658xxxx-j87v\",\"imageId\":\"sha256:61395b4c586da2b9b3b7ca903ea6a448e6783dfdd7f768ff2c1a0f3360aaxxxx\",\"imageName\":\"docker.io/library/nginx:latest\",\"interactive\":true,\"ip\":\"0.0.0.0\",\"label\":\"string\",\"labels\":{},\"md5\":\"string\",\"msg\":\"string\",\"namespace\":\"string\",\"os\":\"Debian GNU/Linux 12 (bookworm)\",\"pid\":0,\"port\":0,\"processPath\":\"string\",\"profileId\":\"string\",\"provider\":\"alibaba\",\"rawEvent\":\"string\",\"region\":\"string\",\"requestID\":\"string\",\"resourceID\":\"string\",\"ruleName\":\"string\",\"runtime\":[\"python3.6\"],\"severity\":[\"low\",\"medium\",\"high\"],\"time\":\"2023-09-19T07:15:31.899Z\",\"type\":[\"processes\"],\"user\":\"string\",\"version\":\"string\",\"vmID\":\"string\",\"wildFireReportURL\":\"string\"}],\"category\":\"malware\",\"cluster\":\"string\",\"collections\":[\"string\"],\"containerID\":\"container123\",\"containerName\":\"Example Container\",\"customRuleName\":\"Rule xyz\",\"fqdn\":\"example.com\",\"function\":\"string\",\"functionID\":\"string\",\"hostname\":\"string\",\"imageID\":\"string\",\"imageName\":\"string\",\"labels\":{},\"namespace\":\"string\",\"profileID\":\"string\",\"provider\":\"oci\",\"region\":\"string\",\"resourceID\":\"string\",\"runtime\":\"string\",\"serialNum\":0,\"shouldCollect\":true,\"time\":\"2023-09-19T07:15:31.899Z\",\"type\":\"host\",\"vmID\":\"string\",\"windows\":true}",
        "type": [
            "info"
        ]
    },
    "host": {
        "domain": [
            "audits-fqdn-hostname",
            "example.com"
        ],
        "hostname": "string"
    },
    "input": {
        "type": "cel"
    },
    "os": {
        "full": [
            "Debian GNU/Linux 12 (bookworm)"
        ]
    },
    "prisma_cloud": {
        "incident_audit": {
            "_id": "651c46b145d15228585exxxx",
            "account_id": "123abc",
            "acknowledged": false,
            "app": {
                "id": "string",
                "value": "string"
            },
            "category": "malware",
            "cluster": "string",
            "collections": [
                "string"
            ],
            "container": {
                "id": "container123",
                "name": "Example Container"
            },
            "custom_rule_name": "Rule xyz",
            "data": [
                {
                    "_id": "651c46b145d15228585exxxx",
                    "account_id": "abdcsfData",
                    "app": {
                        "id": "abc123",
                        "value": "string"
                    },
                    "attack": {
                        "techniques": [
                            "exploitationForPrivilegeEscalation"
                        ],
                        "type": "cloudMetadataProbing"
                    },
                    "cluster": "string",
                    "collections": [
                        "string"
                    ],
                    "command": "string",
                    "container": {
                        "id": "5490e85a1a0c1c9f9c74591a9d3fcbf61beb84a952f14a17277be5fcf00xxxxx",
                        "name": "nginx",
                        "value": true
                    },
                    "count": 0,
                    "country": "string",
                    "domain": "string",
                    "effect": [
                        "block",
                        "prevent"
                    ],
                    "err": "string",
                    "filepath": "string",
                    "fqdn": "audits-fqdn-hostname",
                    "function": {
                        "id": "string",
                        "value": "string"
                    },
                    "hostname": "gke-tp-cluster-tp-pool1-9658xxxx-j87v",
                    "image": {
                        "id": "sha256:61395b4c586da2b9b3b7ca903ea6a448e6783dfdd7f768ff2c1a0f3360aaxxxx",
                        "name": "docker.io/library/nginx:latest"
                    },
                    "interactive": true,
                    "ip": "0.0.0.0",
                    "label": "string",
                    "md5": "string",
                    "msg": "string",
                    "namespace": "string",
                    "os": "Debian GNU/Linux 12 (bookworm)",
                    "pid": 0,
                    "port": 0,
                    "process_path": "string",
                    "profile_id": "string",
                    "provider": "alibaba",
                    "raw_event": "string",
                    "region": "string",
                    "request_id": "string",
                    "resource_id": "string",
                    "rule_name": "string",
                    "runtime": [
                        "python3.6"
                    ],
                    "severity": [
                        "low",
                        "medium",
                        "high"
                    ],
                    "time": "2023-09-19T07:15:31.899Z",
                    "type": [
                        "processes"
                    ],
                    "user": "string",
                    "version": "string",
                    "vm_id": "string",
                    "wild_fire_report_url": "string"
                }
            ],
            "fqdn": "example.com",
            "function": {
                "id": "string",
                "value": "string"
            },
            "hostname": "string",
            "image": {
                "id": "string",
                "name": "string"
            },
            "namespace": "string",
            "profile_id": "string",
            "provider": "oci",
            "region": "string",
            "resource_id": "string",
            "runtime": "string",
            "serial_num": 0,
            "should_collect": true,
            "time": "2023-09-19T07:15:31.899Z",
            "type": "host",
            "vm_id": "string",
            "windows": true
        }
    },
    "related": {
        "hosts": [
            "audits-fqdn-hostname",
            "gke-tp-cluster-tp-pool1-9658xxxx-j87v",
            "example.com",
            "string"
        ],
        "ip": [
            "0.0.0.0"
        ],
        "user": [
            "string"
        ]
    },
    "rule": {
        "name": [
            "string",
            "Rule xyz"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-incident_audit"
    ],
    "threat": {
        "technique": {
            "name": [
                "exploitationForPrivilegeEscalation"
            ],
            "subtechnique": {
                "name": [
                    "cloudMetadataProbing"
                ]
            }
        }
    }
}

{
    "@timestamp": "2025-11-27T07:15:31.063Z",
    "agent": {
        "ephemeral_id": "10e6dcfd-2426-449c-ad88-dd7b950c6ff6",
        "id": "ef0fcaa5-8765-4499-86d8-6dd2bc23a7fe",
        "name": "elastic-agent-53293",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "cloud": {
        "account": {
            "id": "aa88885-8888-4444-8fd2-00000000efc3",
            "name": "Azure Account"
        },
        "provider": "azure",
        "region": "westeurope"
    },
    "data_stream": {
        "dataset": "prisma_cloud.misconfiguration",
        "namespace": "89870",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "ef0fcaa5-8765-4499-86d8-6dd2bc23a7fe",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "configuration"
        ],
        "dataset": "prisma_cloud.misconfiguration",
        "id": "4b000a6af8c000b000ecd6c91c0000bd|463d8b58-1f01-462c-9e30-eca36d8fa11d",
        "ingested": "2025-11-27T07:15:34Z",
        "kind": [
            "state"
        ],
        "original": "{\"accountId\":\"aa88885-8888-4444-8fd2-00000000efc3\",\"accountName\":\"Azure Account\",\"alertStatus\":{\"critical\":0,\"high\":0,\"informational\":0,\"low\":0,\"medium\":1},\"appNames\":[\"CSPM\"],\"assetType\":\"Azure Log Analytics Workspace\",\"cloudType\":\"azure\",\"id\":\"/subscriptions/aa88885-8888-4444-8fd2-00000000efc3/resourceGroups/grpc/providers/Microsoft.OperationalInsights/workspaces/sampleworkpace\",\"name\":\"sampleworkpace\",\"overallPassed\":false,\"regionId\":\"westeurope\",\"regionName\":\"Azure West Europe\",\"resourceConfigJsonAvailable\":true,\"resourceDetailsAvailable\":true,\"rrn\":\"rrn:azure:other:westeurope:aa88885-8888-4444-8fd2-00000000efc3:b3b5eadac382f498db09acc473e5c20a281d420b:%2Fsubscriptions%2Faa88885-8888-4444-8fd2-00000000efc3%2FresourceGroups%2Fgrpc%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Fsampleworkpace\",\"scannedPolicy\":{\"id\":\"463d8b58-1f01-462c-9e30-eca36d8fa11d\",\"labels\":[],\"name\":\"Azure Log Analytics workspace configured with overly permissive network access\",\"passed\":false,\"severity\":\"medium\"},\"unifiedAssetId\":\"4b000a6af8c000b000ecd6c91c0000bd\"}",
        "outcome": "failure",
        "severity": 47,
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "product": "Prisma Cloud",
        "vendor": "Palo Alto Networks"
    },
    "prisma_cloud": {
        "misconfiguration": {
            "account_id": "aa88885-8888-4444-8fd2-00000000efc3",
            "account_name": "Azure Account",
            "alert_status": {
                "critical": 0,
                "high": 0,
                "informational": 0,
                "low": 0,
                "medium": 1
            },
            "app_names": [
                "CSPM"
            ],
            "asset_type": "Azure Log Analytics Workspace",
            "cloud_type": "azure",
            "id": "/subscriptions/aa88885-8888-4444-8fd2-00000000efc3/resourceGroups/grpc/providers/Microsoft.OperationalInsights/workspaces/sampleworkpace",
            "name": "sampleworkpace",
            "overall_passed": false,
            "region_id": "westeurope",
            "region_name": "Azure West Europe",
            "resource_config_json_available": true,
            "resource_details_available": true,
            "rrn": "rrn:azure:other:westeurope:aa88885-8888-4444-8fd2-00000000efc3:b3b5eadac382f498db09acc473e5c20a281d420b:%2Fsubscriptions%2Faa88885-8888-4444-8fd2-00000000efc3%2FresourceGroups%2Fgrpc%2Fproviders%2FMicrosoft.OperationalInsights%2Fworkspaces%2Fsampleworkpace",
            "scanned_policy": {
                "id": "463d8b58-1f01-462c-9e30-eca36d8fa11d",
                "name": "Azure Log Analytics workspace configured with overly permissive network access",
                "passed": false,
                "severity": "medium"
            },
            "unified_asset_id": "4b000a6af8c000b000ecd6c91c0000bd"
        }
    },
    "resource": {
        "id": "4b000a6af8c000b000ecd6c91c0000bd",
        "name": "sampleworkpace",
        "type": "Azure Log Analytics Workspace"
    },
    "result": {
        "evaluation": "failed"
    },
    "rule": {
        "id": "463d8b58-1f01-462c-9e30-eca36d8fa11d",
        "name": "Azure Log Analytics workspace configured with overly permissive network access",
        "uuid": "463d8b58-1f01-462c-9e30-eca36d8fa11d"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-misconfiguration"
    ]
}

{
    "@timestamp": "2025-11-24T11:14:27.343Z",
    "agent": {
        "ephemeral_id": "ff38bb76-0d40-45d4-be98-c2d9b41abab6",
        "id": "d5069261-976a-41c4-aa9b-2213f41fc950",
        "name": "elastic-agent-54334",
        "type": "filebeat",
        "version": "8.19.4"
    },
    "cloud": {
        "account": {
            "id": "aa8f0000-0000-0000-8fd1-00100000efc3"
        },
        "provider": "azure"
    },
    "data_stream": {
        "dataset": "prisma_cloud.vulnerability",
        "namespace": "86934",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "d5069261-976a-41c4-aa9b-2213f41fc950",
        "snapshot": false,
        "version": "8.19.4"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "dataset": "prisma_cloud.vulnerability",
        "id": "bb000aa950d40000d5b000a6b0c3a2f|CVE-2024-39298",
        "ingested": "2025-11-24T11:14:30Z",
        "kind": [
            "event"
        ],
        "original": "{\"3RD_PARTY_EXPLOIT_SOURCE\":\"N/A\",\"ASSET_ID\":\"bb000aa950d40000d5b000a6b0c3a2f\",\"ASSET_TYPE\":\"host\",\"ATTACK_COMPLEXITY\":\"Low\",\"ATTACK_VECTOR\":\"Local\",\"AT_RISK\":\"N\",\"CISA_KEV\":\"N\",\"CLOUD_ACCOUNT_ID\":\"aa8f0000-0000-0000-8fd1-00100000efc3\",\"CVE_ID\":\"CVE-2024-39298\",\"CVE_LINK\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-39298\",\"CVSS_BASE_SCORE\":\"5.5\",\"DISCOVERED_DATE\":\"Oct 31 2025\",\"DISTRIBUTION\":\"ubuntu\",\"DOS\":\"high\",\"EPSS_SCORE\":\"8.8E-4\",\"EXPLOITABLE\":\"N\",\"FIX_DATE\":\"N/A\",\"FIX_VERSION\":\"[N/A]\",\"INSTALLED_VERSIONS\":\"[5.15.0-161.171]\",\"INTERNET_EXPOSED\":\"Y\",\"OS_RELEASE\":\"jammy\",\"PACKAGE_IN_USE\":\"false\",\"PACKAGE_NAME\":\"linux\",\"PATCHABLE\":\"N\",\"PRIVILEGES_REQUIRED\":\"Low\",\"PUBLISHED_DATE\":\"N/A\",\"REGISTRY\":\"N/A\",\"SERVICE_PROVIDER\":\"azure\",\"SEVERITY\":\"medium\",\"USER_INTERACTION\":\"None\"}",
        "type": [
            "info"
        ]
    },
    "host": {
        "id": "bb000aa950d40000d5b000a6b0c3a2f",
        "os": {
            "platform": "ubuntu"
        }
    },
    "input": {
        "type": "cel"
    },
    "observer": {
        "product": "Prisma Cloud",
        "vendor": "Palo Alto Networks"
    },
    "package": {
        "name": "linux",
        "version": [
            "5.15.0-161.171"
        ]
    },
    "prisma_cloud": {
        "vulnerability": {
            "asset_id": "bb000aa950d40000d5b000a6b0c3a2f",
            "asset_type": "host",
            "at_risk": "N",
            "attack_complexity": "Low",
            "attack_vector": "Local",
            "cisa_kev": "N",
            "cloud_account_id": "aa8f0000-0000-0000-8fd1-00100000efc3",
            "cve_id": "CVE-2024-39298",
            "cve_link": "https://nvd.nist.gov/vuln/detail/CVE-2024-39298",
            "cvss_base_score": 5.5,
            "discovered_date": "2025-10-31T00:00:00.000Z",
            "distribution": "ubuntu",
            "dos": "high",
            "epss_score": 0.00088,
            "exploitable": "N",
            "installed_versions": [
                "5.15.0-161.171"
            ],
            "internet_exposed": "Y",
            "os_release": "jammy",
            "package_in_use": false,
            "package_name": "linux",
            "patchable": "N",
            "privileges_required": "Low",
            "service_provider": "azure",
            "severity": "medium",
            "user_interaction": "None"
        }
    },
    "related": {
        "hosts": [
            "bb000aa950d40000d5b000a6b0c3a2f"
        ]
    },
    "resource": {
        "id": "bb000aa950d40000d5b000a6b0c3a2f"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "prisma_cloud-vulnerability"
    ],
    "vulnerability": {
        "classification": "CVSS",
        "cve": "CVE-2024-39298",
        "enumeration": "CVE",
        "id": "CVE-2024-39298",
        "reference": "https://nvd.nist.gov/vuln/detail/CVE-2024-39298",
        "scanner": {
            "vendor": "Palo Alto Networks"
        },
        "score": {
            "base": 5.5
        },
        "severity": "Medium",
        "title": "Vulnerability found in linux versions [5.15.0-161.171] - CVE-2024-39298"
    }
}