Flashpoint Integration for Elastic

{
    "@timestamp": "2025-12-12T11:41:37.775Z",
    "agent": {
        "ephemeral_id": "fe828f18-6ee6-4c80-ba23-4e05f7ac3655",
        "id": "581405cc-6161-4ad5-853b-43a910e3824f",
        "name": "elastic-agent-71469",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "container": {
        "id": "966491148640211034",
        "name": "newbies-2"
    },
    "data_stream": {
        "dataset": "ti_flashpoint.alert",
        "namespace": "75359",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "581405cc-6161-4ad5-853b-43a910e3824f",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "created": "2025-12-12T11:41:37.775Z",
        "dataset": "ti_flashpoint.alert",
        "id": "1fc0fc04-5a85-41ff-970d-acda1c0dd390",
        "ingested": "2026-02-16T06:22:52Z",
        "kind": "alert",
        "original": "{\"created_at\":\"2025-12-12T11:41:37.775301Z\",\"data_type\":\"news\",\"generated_at\":\"2025-12-12T11:41:35.896396Z\",\"highlight_text\":\"16\\nImage \\u003cmark\\u003eCredit\\u003c/mark\\u003e :\",\"highlights\":{\"body.text/plain\":[\"16\\nImage \\u003cmark\\u003eCredit\\u003c/mark\\u003e.\"]},\"id\":\"1fc0fc04-5a85-41ff-970d-acda1c0dd390\",\"is_read\":false,\"parent_data_type\":null,\"reason\":{\"details\":{\"params\":{\"exclude\":{},\"include\":{\"date\":{\"end\":\"now\",\"label\":\"Last 30 Days\",\"start\":\"now-30d\"}}},\"sources\":[\"communities\",\"media\",\"marketplaces\",\"news\"]},\"entity\":null,\"id\":\"0f325ca9-a28f-421b-8d0c-db3329366e5f\",\"name\":\"credit\",\"origin\":\"searches\",\"text\":\"credit\"},\"resource\":{\"author\":\"Alias Doe\",\"authors\":[\"Alias Doe\"],\"basetypes\":[\"article\",\"news\",\"newscatcher\"],\"container\":{\"name\":\"newbies-2\",\"native_id\":\"966491148640211034\"},\"country\":\"IN\",\"created_at\":{\"date-time\":\"2025-12-12T09:06:06+00:00\",\"raw\":\"2025-12-12 09:06:06\",\"timestamp\":1765530366},\"description\":\"Rajinikanth, who has ruled both South and Bollywood cinema, turns 75 today. Born on December 12, 1950, the superstar continues to deliver box-office blockbusters and is now gearing up for several exciting upcoming films.\",\"id\":\"c4FF4mbNV7m2vBWPIaV0uw\",\"link\":\"https://example.com\",\"media_v2\":[{\"mime_type\":\"image/jpeg\",\"phash\":\"9a996984a473e3c7\",\"phash256\":\"9abe917a69c984a6a4d47368e34cc526ed85658cc913cdb3986b9b4cd31c3673\",\"sha1\":\"ddc7b1f8b32056803bdce609c1262e59836bec87\",\"storage_uri\":\"gs://kraken-datalake-media/artifacts/71/71a2a7e557b989f25b89a7cbd9ec3a65183a4717bc2a05ede89971064f177b58\"}],\"site\":{\"title\":\"example.com\"},\"sort_date\":\"2025-12-12T09:06:06Z\",\"title\":\"Jailer 2 to Coolie 2: Rajinikanth at 75 Ready to Thrill Fans with Upcoming Hits\"},\"source\":\"news\",\"status\":null,\"tags\":{}}",
        "reason": "credit",
        "url": "https://example.com"
    },
    "file": {
        "hash": {
            "sha1": [
                "ddc7b1f8b32056803bdce609c1262e59836bec87"
            ]
        },
        "mime_type": [
            "image/jpeg"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hash": [
            "9a996984a473e3c7",
            "9abe917a69c984a6a4d47368e34cc526ed85658cc913cdb3986b9b4cd31c3673",
            "ddc7b1f8b32056803bdce609c1262e59836bec87"
        ],
        "user": [
            "Alias Doe"
        ]
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "ti_flashpoint-alert"
    ],
    "ti_flashpoint": {
        "alert": {
            "created_at": "2025-12-12T11:41:37.775Z",
            "data_type": "news",
            "generated_at": "2025-12-12T11:41:35.896Z",
            "highlight_text": "16\nImage <mark>Credit</mark> :",
            "highlights": {
                "body.text/plain": [
                    "16\nImage <mark>Credit</mark>."
                ]
            },
            "id": "1fc0fc04-5a85-41ff-970d-acda1c0dd390",
            "is_read": false,
            "reason": {
                "details": {
                    "params": {
                        "include": {
                            "date": {
                                "end": "now",
                                "label": "Last 30 Days",
                                "start": "now-30d"
                            }
                        }
                    },
                    "sources": [
                        "communities",
                        "media",
                        "marketplaces",
                        "news"
                    ]
                },
                "id": "0f325ca9-a28f-421b-8d0c-db3329366e5f",
                "name": "credit",
                "origin": "searches",
                "text": "credit"
            },
            "resource": {
                "author": "Alias Doe",
                "authors": [
                    "Alias Doe"
                ],
                "basetypes": [
                    "article",
                    "news",
                    "newscatcher"
                ],
                "container": {
                    "name": "newbies-2",
                    "native_id": "966491148640211034"
                },
                "country": "IN",
                "created_at": "2025-12-12T09:06:06.000Z",
                "description": "Rajinikanth, who has ruled both South and Bollywood cinema, turns 75 today. Born on December 12, 1950, the superstar continues to deliver box-office blockbusters and is now gearing up for several exciting upcoming films.",
                "id": "c4FF4mbNV7m2vBWPIaV0uw",
                "link": "https://example.com",
                "media_v2": [
                    {
                        "mime_type": "image/jpeg",
                        "phash": "9a996984a473e3c7",
                        "phash256": "9abe917a69c984a6a4d47368e34cc526ed85658cc913cdb3986b9b4cd31c3673",
                        "sha1": "ddc7b1f8b32056803bdce609c1262e59836bec87",
                        "storage_uri": "gs://kraken-datalake-media/artifacts/71/71a2a7e557b989f25b89a7cbd9ec3a65183a4717bc2a05ede89971064f177b58"
                    }
                ],
                "site": {
                    "title": "example.com"
                },
                "sort_date": "2025-12-12T09:06:06.000Z",
                "title": "Jailer 2 to Coolie 2: Rajinikanth at 75 Ready to Thrill Fans with Upcoming Hits"
            },
            "source": "news"
        }
    },
    "user": {
        "name": "Alias Doe"
    }
}

{
    "@timestamp": "2025-12-23T10:58:20.798Z",
    "agent": {
        "ephemeral_id": "fb292815-193e-4385-b8fd-874bec678aa1",
        "id": "f8d04f25-1e2d-4a99-bdf0-3a210b15d23e",
        "name": "elastic-agent-81532",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "ti_flashpoint.indicator",
        "namespace": "97654",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "f8d04f25-1e2d-4a99-bdf0-3a210b15d23e",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "created": "2025-11-03T08:35:08.714Z",
        "dataset": "ti_flashpoint.indicator",
        "id": "EtniFes7WyWvawEXcL2fmQ",
        "ingested": "2026-03-26T06:34:57Z",
        "kind": "enrichment",
        "original": "{\"created_at\":\"2025-11-03T08:35:08.714000Z\",\"entity_type\":\"indicator\",\"href\":\"https://api.flashpoint.io/technical-intelligence/v2/indicators/EtniFes7WyWvawEXcL2fmQ\",\"id\":\"EtniFes7WyWvawEXcL2fmQ\",\"last_seen_at\":\"2025-12-23T10:47:29.731000Z\",\"latest_sighting\":{\"description\":\"Observation: xworm [2025-12-23T10:47:29.731Z]\",\"href\":\"https://api.flashpoint.io/technical-intelligence/v2/sightings/-mQDA1JEVYiXKTSenQuSbg\",\"id\":\"-mQDA1JEVYiXKTSenQuSbg\",\"sighted_at\":\"2025-12-23T10:47:29.731000Z\",\"source\":\"flashpoint_extraction\",\"tags\":[\"aes_key:be7b7befe99d381fbe34ef443b3179be7b7befe99d381fbe34ef443b31790e00\",\"extracted_config:true\",\"group:feturednew\",\"malware:xworm\",\"mutex:hr5unzmp8fhkimje\",\"source:flashpoint_extraction\",\"type:trojan\"]},\"modified_at\":\"2025-12-23T10:58:20.798000Z\",\"platform_urls\":{\"ignite\":\"https://app.flashpoint.io/cti/malware/iocs/EtniFes7WyWvawEXcL2fmQ\"},\"score\":{\"last_scored_at\":\"2025-11-03T08:46:17.620389Z\",\"value\":\"informational\"},\"sightings\":[{\"description\":\"Observation: xworm [2025-12-23T10:47:29.731Z]\",\"href\":\"https://api.flashpoint.io/technical-intelligence/v2/sightings/-mQDA1JEVYiXKTSenQuSbg\",\"id\":\"-mQDA1JEVYiXKTSenQuSbg\",\"sighted_at\":\"2025-12-23T10:47:29.731000Z\",\"source\":\"flashpoint_extraction\",\"tags\":[\"aes_key:be7b7befe99d381fbe34ef443b3179be7b7befe99d381fbe34ef443b31790e00\",\"extracted_config:true\",\"group:feturednew\",\"malware:xworm\",\"mutex:hr5unzmp8fhkimje\",\"source:flashpoint_extraction\",\"type:trojan\"]}],\"sort_date\":\"2025-12-23T10:47:29.731000Z\",\"total_sightings\":11,\"type\":\"domain\",\"value\":\"featured.xyz\"}",
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "cel"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "ti_flashpoint-indicator"
    ],
    "threat": {
        "indicator": {
            "id": [
                "EtniFes7WyWvawEXcL2fmQ"
            ],
            "last_seen": "2025-12-23T10:47:29.731Z",
            "modified_at": "2025-12-23T10:58:20.798Z",
            "reference": [
                "https://app.flashpoint.io/cti/malware/iocs/EtniFes7WyWvawEXcL2fmQ",
                "https://api.flashpoint.io/technical-intelligence/v2/indicators/EtniFes7WyWvawEXcL2fmQ"
            ],
            "type": "domain-name"
        }
    },
    "ti_flashpoint": {
        "indicator": {
            "created_at": "2025-11-03T08:35:08.714Z",
            "entity_type": "indicator",
            "href": "https://api.flashpoint.io/technical-intelligence/v2/indicators/EtniFes7WyWvawEXcL2fmQ",
            "id": "EtniFes7WyWvawEXcL2fmQ",
            "last_seen_at": "2025-12-23T10:47:29.731Z",
            "latest_sighting": {
                "description": "Observation: xworm [2025-12-23T10:47:29.731Z]",
                "href": "https://api.flashpoint.io/technical-intelligence/v2/sightings/-mQDA1JEVYiXKTSenQuSbg",
                "id": "-mQDA1JEVYiXKTSenQuSbg",
                "sighted_at": "2025-12-23T10:47:29.731Z",
                "source": "flashpoint_extraction",
                "tags": [
                    "aes_key:be7b7befe99d381fbe34ef443b3179be7b7befe99d381fbe34ef443b31790e00",
                    "extracted_config:true",
                    "group:feturednew",
                    "malware:xworm",
                    "mutex:hr5unzmp8fhkimje",
                    "source:flashpoint_extraction",
                    "type:trojan"
                ]
            },
            "modified_at": "2025-12-23T10:58:20.798Z",
            "platform_urls": {
                "ignite": "https://app.flashpoint.io/cti/malware/iocs/EtniFes7WyWvawEXcL2fmQ"
            },
            "score": {
                "last_scored_at": "2025-11-03T08:46:17.620Z",
                "value": "informational"
            },
            "sightings": [
                {
                    "description": "Observation: xworm [2025-12-23T10:47:29.731Z]",
                    "href": "https://api.flashpoint.io/technical-intelligence/v2/sightings/-mQDA1JEVYiXKTSenQuSbg",
                    "id": "-mQDA1JEVYiXKTSenQuSbg",
                    "sighted_at": "2025-12-23T10:47:29.731Z",
                    "source": "flashpoint_extraction",
                    "tags": [
                        "aes_key:be7b7befe99d381fbe34ef443b3179be7b7befe99d381fbe34ef443b31790e00",
                        "extracted_config:true",
                        "group:feturednew",
                        "malware:xworm",
                        "mutex:hr5unzmp8fhkimje",
                        "source:flashpoint_extraction",
                        "type:trojan"
                    ]
                }
            ],
            "sort_date": "2025-12-23T10:47:29.731Z",
            "total_sightings": 11,
            "type": "domain",
            "value": "featured.xyz"
        }
    }
}

{
    "@timestamp": "2025-12-29T23:00:01.000Z",
    "agent": {
        "ephemeral_id": "a731b22a-997d-4b91-add8-54e3bcbed26e",
        "id": "464a3ca4-9a12-4a88-8083-7d2a364dc9d8",
        "name": "elastic-agent-10945",
        "type": "filebeat",
        "version": "8.18.0"
    },
    "data_stream": {
        "dataset": "ti_flashpoint.vulnerability",
        "namespace": "21891",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "464a3ca4-9a12-4a88-8083-7d2a364dc9d8",
        "snapshot": false,
        "version": "8.18.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "vulnerability"
        ],
        "created": "2025-12-29T22:49:59.000Z",
        "dataset": "ti_flashpoint.vulnerability",
        "id": "432898",
        "ingested": "2026-03-09T07:06:13Z",
        "kind": "state",
        "original": "{\"classifications\":[{\"description\":\"Local access is required to exploit this vulnerability (e.g., unix shell, windows user).\",\"longname\":\"Local Access Required\",\"name\":\"location_local\"},{\"description\":\"A vulnerability that cannot be defined by any other Attack Type classification.\",\"longname\":\"Other\",\"name\":\"attack_type_other\"},{\"description\":\"Assurance that data is protected and not disclosed to unauthorized party.\\r\\nExamples: password disclosures, server information, environment variables, confirmation of file existance, path dislcosure, file content access, some SQL injection.\",\"longname\":\"Loss of Confidentiality\",\"name\":\"impact_confidential\"},{\"description\":\"Assurance that data is unaltered by unauthorized persons and authorization has not been exceeded.\\r\\nExamples: XSS, arbitrary command execution, most overflows, most format strings, SQL injection, unauthorized file modification/deletion/creation, remote file inclusion, etc.\",\"longname\":\"Loss of Integrity\",\"name\":\"impact_integrity\"},{\"description\":\"The status of a working exploit is unknown.\",\"longname\":\"Exploit Unknown\",\"name\":\"exploit_unknown\"},{\"description\":\"The vulnerability can be mitigated by installing the vendor-supplied upgrade.\",\"longname\":\"Upgrade\",\"name\":\"solution_upgrade\"},{\"description\":\"The vendor has verified this vulnerability.\",\"longname\":\"Vendor Verified\",\"name\":\"disclosure_verified\"},{\"description\":\"The researcher and vendor coordinated disclosure so that vulnerability details were released in conjunction with a solution.\",\"longname\":\"Coordinated Disclosure\",\"name\":\"disclosure_coordinated_disclosure\"},{\"description\":\"This vulnerability can only be exploited after successful authentication.\",\"longname\":\"Authentication Required\",\"name\":\"vuln_authentication_required\"}],\"cve_ids\":[\"CVE-2025-13326\"],\"cvss_v2s\":[{\"access_complexity\":\"MEDIUM\",\"access_vector\":\"LOCAL\",\"authentication\":\"NONE\",\"availability_impact\":\"NONE\",\"calculated_cvss_base_score\":1.9,\"confidentiality_impact\":\"NONE\",\"cve_id\":null,\"generated_at\":\"2025-12-29T20:10:04Z\",\"integrity_impact\":\"PARTIAL\",\"score\":1.9,\"source\":\"Flashpoint\"}],\"cvss_v3s\":[{\"attack_complexity\":\"LOW\",\"attack_vector\":\"LOCAL\",\"availability_impact\":\"NONE\",\"calculated_cvss_base_score\":3.9,\"confidentiality_impact\":\"LOW\",\"cve_id\":null,\"exploit_code_maturity\":\"UNPROVEN\",\"generated_at\":\"2025-12-29T20:10:04Z\",\"integrity_impact\":\"LOW\",\"privileges_required\":\"LOW\",\"remediation_level\":\"OFFICIAL_FIX\",\"report_confidence\":\"CONFIRMED\",\"scope\":\"UNCHANGED\",\"score\":3.9,\"source\":\"Flashpoint\",\"temporal_score\":3.4,\"updated_at\":\"2025-12-29T22:49:59Z\",\"user_interaction\":\"REQUIRED\",\"vector_string\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C\",\"version\":\"3.1\"}],\"cvss_v4s\":[{\"attack_complexity\":\"LOW\",\"attack_requirements\":\"NONE\",\"attack_vector\":\"LOCAL\",\"cve_id\":null,\"exploit_maturity\":\"NOT_DEFINED\",\"generated_at\":\"2025-12-29T20:10:04.144000Z\",\"privileges_required\":\"LOW\",\"score\":2.4,\"source\":\"Flashpoint\",\"subsequent_system_availability_impact\":\"NONE\",\"subsequent_system_confidentiality_impact\":\"NONE\",\"subsequent_system_integrity_impact\":\"NONE\",\"threat_score\":2.4,\"updated_at\":\"2025-12-29T20:10:04.254000Z\",\"user_interaction\":\"PASSIVE\",\"vector_string\":\"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X\",\"version\":\"4.0\",\"vulnerable_system_availability_impact\":\"NONE\",\"vulnerable_system_confidentiality_impact\":\"LOW\",\"vulnerable_system_integrity_impact\":\"LOW\"}],\"cwes\":[{\"cve_ids\":\"2025-13326\",\"cwe_id\":693,\"name\":\"Protection Mechanism Failure\",\"source\":\"mitre\"}],\"description\":\"Mattermost Desktop contains a flaw that is triggered as the program fails to enable the Hardened Runtime setting when packaged for Mac App Store. This may allow a local attacker to inherit TCC permissions via copying the binary to a tmp folder.\",\"exploits_count\":0,\"ext_references\":[{\"created_at\":\"2020-09-09T19:57:14Z\",\"description\":null,\"type\":\"Vendor Specific Advisory URL\",\"url\":\"https://mattermost.com/security-updates/\",\"value\":\"https://mattermost.com/security-updates/\"},{\"created_at\":\"2025-12-23T17:58:58Z\",\"description\":null,\"type\":\"Generic Informational URL\",\"url\":\"https://www.cisa.gov/news-events/bulletins/sb25-356\",\"value\":\"https://www.cisa.gov/news-events/bulletins/sb25-356\"},{\"created_at\":\"2025-12-17T18:20:42Z\",\"description\":null,\"type\":\"CVE ID\",\"url\":\"https://www.cve.org/CVERecord?id=CVE-2025-13326\",\"value\":\"2025-13326\"}],\"id\":432898,\"keywords\":\"MMSA-2025-00504\",\"products\":[{\"id\":2985883,\"name\":\"Mattermost Desktop\"}],\"scores\":{\"cvssv3_score\":3.9,\"epss_score\":0.00013,\"epss_v1_score\":0,\"ransomware_score\":\"Low\",\"severity\":\"Low\"},\"solution\":\"It has been reported that this has been fixed. Please refer to the product listing for upgraded versions that address this vulnerability.\",\"tags\":[\"oss\"],\"technical_description\":\"\",\"timelines\":{\"disclosed_at\":\"2025-11-17T00:00:00Z\",\"discovered_at\":null,\"exploit_published_at\":null,\"exploited_in_the_wild_at\":null,\"last_modified_at\":\"2025-12-29T23:00:01Z\",\"published_at\":\"2025-12-29T22:49:59Z\",\"solution_provided_at\":\"2025-11-17T00:00:00Z\",\"third_party_solution_provided_at\":null,\"vendor_acknowledged_at\":null,\"vendor_informed_at\":null},\"title\":\"Mattermost Desktop Hardened Runtime Protection Mechanism Failure Local TCC Privilege Escalation\",\"vendors\":[{\"id\":2803312,\"name\":\"Mattermost\"}],\"vuln_status\":\"Active\"}",
        "type": [
            "info"
        ]
    },
    "input": {
        "type": "cel"
    },
    "message": "Mattermost Desktop contains a flaw that is triggered as the program fails to enable the Hardened Runtime setting when packaged for Mac App Store. This may allow a local attacker to inherit TCC permissions via copying the binary to a tmp folder.",
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "ti_flashpoint-vulnerability"
    ],
    "ti_flashpoint": {
        "vulnerability": {
            "classifications": [
                {
                    "description": "Local access is required to exploit this vulnerability (e.g., unix shell, windows user).",
                    "longname": "Local Access Required",
                    "name": "location_local"
                },
                {
                    "description": "A vulnerability that cannot be defined by any other Attack Type classification.",
                    "longname": "Other",
                    "name": "attack_type_other"
                },
                {
                    "description": "Assurance that data is protected and not disclosed to unauthorized party.\r\nExamples: password disclosures, server information, environment variables, confirmation of file existance, path dislcosure, file content access, some SQL injection.",
                    "longname": "Loss of Confidentiality",
                    "name": "impact_confidential"
                },
                {
                    "description": "Assurance that data is unaltered by unauthorized persons and authorization has not been exceeded.\r\nExamples: XSS, arbitrary command execution, most overflows, most format strings, SQL injection, unauthorized file modification/deletion/creation, remote file inclusion, etc.",
                    "longname": "Loss of Integrity",
                    "name": "impact_integrity"
                },
                {
                    "description": "The status of a working exploit is unknown.",
                    "longname": "Exploit Unknown",
                    "name": "exploit_unknown"
                },
                {
                    "description": "The vulnerability can be mitigated by installing the vendor-supplied upgrade.",
                    "longname": "Upgrade",
                    "name": "solution_upgrade"
                },
                {
                    "description": "The vendor has verified this vulnerability.",
                    "longname": "Vendor Verified",
                    "name": "disclosure_verified"
                },
                {
                    "description": "The researcher and vendor coordinated disclosure so that vulnerability details were released in conjunction with a solution.",
                    "longname": "Coordinated Disclosure",
                    "name": "disclosure_coordinated_disclosure"
                },
                {
                    "description": "This vulnerability can only be exploited after successful authentication.",
                    "longname": "Authentication Required",
                    "name": "vuln_authentication_required"
                }
            ],
            "cve_ids": [
                "CVE-2025-13326"
            ],
            "cvss_v2s": [
                {
                    "access_complexity": "MEDIUM",
                    "access_vector": "LOCAL",
                    "authentication": "NONE",
                    "availability_impact": "NONE",
                    "calculated_cvss_base_score": 1.9,
                    "confidentiality_impact": "NONE",
                    "generated_at": "2025-12-29T20:10:04.000Z",
                    "integrity_impact": "PARTIAL",
                    "score": 1.9,
                    "source": "Flashpoint"
                }
            ],
            "cvss_v3s": [
                {
                    "attack_complexity": "LOW",
                    "attack_vector": "LOCAL",
                    "availability_impact": "NONE",
                    "calculated_cvss_base_score": 3.9,
                    "confidentiality_impact": "LOW",
                    "exploit_code_maturity": "UNPROVEN",
                    "generated_at": "2025-12-29T20:10:04.000Z",
                    "integrity_impact": "LOW",
                    "privileges_required": "LOW",
                    "remediation_level": "OFFICIAL_FIX",
                    "report_confidence": "CONFIRMED",
                    "scope": "UNCHANGED",
                    "score": 3.9,
                    "source": "Flashpoint",
                    "temporal_score": 3.4,
                    "updated_at": "2025-12-29T22:49:59.000Z",
                    "user_interaction": "REQUIRED",
                    "vector_string": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C",
                    "version": "3.1"
                }
            ],
            "cvss_v4s": [
                {
                    "attack_complexity": "LOW",
                    "attack_requirements": "NONE",
                    "attack_vector": "LOCAL",
                    "exploit_maturity": "NOT_DEFINED",
                    "generated_at": "2025-12-29T20:10:04.144Z",
                    "privileges_required": "LOW",
                    "score": 2.4,
                    "source": "Flashpoint",
                    "subsequent_system_availability_impact": "NONE",
                    "subsequent_system_confidentiality_impact": "NONE",
                    "subsequent_system_integrity_impact": "NONE",
                    "threat_score": 2.4,
                    "updated_at": "2025-12-29T20:10:04.254Z",
                    "user_interaction": "PASSIVE",
                    "vector_string": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X",
                    "version": "4.0",
                    "vulnerable_system_availability_impact": "NONE",
                    "vulnerable_system_confidentiality_impact": "LOW",
                    "vulnerable_system_integrity_impact": "LOW"
                }
            ],
            "cwes": [
                {
                    "cve_ids": "2025-13326",
                    "cwe_id": "693",
                    "name": "Protection Mechanism Failure",
                    "source": "mitre"
                }
            ],
            "description": "Mattermost Desktop contains a flaw that is triggered as the program fails to enable the Hardened Runtime setting when packaged for Mac App Store. This may allow a local attacker to inherit TCC permissions via copying the binary to a tmp folder.",
            "exploits_count": 0,
            "ext_references": [
                {
                    "created_at": "2020-09-09T19:57:14.000Z",
                    "type": "Vendor Specific Advisory URL",
                    "url": "https://mattermost.com/security-updates/",
                    "value": "https://mattermost.com/security-updates/"
                },
                {
                    "created_at": "2025-12-23T17:58:58.000Z",
                    "type": "Generic Informational URL",
                    "url": "https://www.cisa.gov/news-events/bulletins/sb25-356",
                    "value": "https://www.cisa.gov/news-events/bulletins/sb25-356"
                },
                {
                    "created_at": "2025-12-17T18:20:42.000Z",
                    "type": "CVE ID",
                    "url": "https://www.cve.org/CVERecord?id=CVE-2025-13326",
                    "value": "2025-13326"
                }
            ],
            "id": "432898",
            "keywords": "MMSA-2025-00504",
            "products": [
                {
                    "id": "2985883",
                    "name": "Mattermost Desktop"
                }
            ],
            "scores": {
                "cvssv3_score": 3.9,
                "epss_score": 0.00013,
                "epss_v1_score": 0,
                "ransomware_score": "Low",
                "severity": "Low"
            },
            "solution": "It has been reported that this has been fixed. Please refer to the product listing for upgraded versions that address this vulnerability.",
            "tags": [
                "oss"
            ],
            "timelines": {
                "disclosed_at": "2025-11-17T00:00:00.000Z",
                "last_modified_at": "2025-12-29T23:00:01.000Z",
                "published_at": "2025-12-29T22:49:59.000Z",
                "solution_provided_at": "2025-11-17T00:00:00.000Z"
            },
            "title": "Mattermost Desktop Hardened Runtime Protection Mechanism Failure Local TCC Privilege Escalation",
            "vendors": [
                {
                    "id": "2803312",
                    "name": "Mattermost"
                }
            ],
            "vuln_status": "Active"
        }
    },
    "vulnerability": {
        "classification": "CVSS",
        "cve": [
            "CVE-2025-13326"
        ],
        "description": "Mattermost Desktop contains a flaw that is triggered as the program fails to enable the Hardened Runtime setting when packaged for Mac App Store. This may allow a local attacker to inherit TCC permissions via copying the binary to a tmp folder.",
        "id": [
            "CVE-2025-13326"
        ],
        "published_date": "2025-12-29T22:49:59.000Z",
        "reference": [
            "https://mattermost.com/security-updates/",
            "https://www.cisa.gov/news-events/bulletins/sb25-356",
            "https://www.cve.org/CVERecord?id=CVE-2025-13326"
        ],
        "scanner": {
            "vendor": "Flashpoint"
        },
        "score": {
            "base": [
                2.4
            ],
            "temporal": [
                3.4
            ],
            "version": [
                "4.0"
            ]
        },
        "severity": "Low"
    }
}

{
    "@timestamp": "2025-02-08T08:00:00.000Z",
    "agent": {
        "ephemeral_id": "238c442d-0d91-4e5f-8b93-e366d7679cf5",
        "id": "55f07b5c-7647-4039-b68d-cf1b1f14a800",
        "name": "elastic-agent-56277",
        "type": "filebeat",
        "version": "8.19.0"
    },
    "data_stream": {
        "dataset": "ti_flashpoint.sighting",
        "namespace": "55015",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "55f07b5c-7647-4039-b68d-cf1b1f14a800",
        "snapshot": false,
        "version": "8.19.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "ti_flashpoint.sighting",
        "ingested": "2026-10-19T14:17:18Z",
        "kind": "event",
        "original": "{\"affected_domain\":\"example.com\",\"affected_url\":\"https://sso.example.com/login\",\"basetypes\":[\"credential-sighting\"],\"body\":\"jdoe@example.com:P@ssw0rd123\",\"breach\":{\"basetypes\":[\"breach\"],\"breach_type\":\"credential\",\"created_at\":{\"date-time\":\"2025-01-15T00:00:00Z\",\"timestamp\":1736899200},\"first_observed_at\":{\"date-time\":\"2025-01-20T00:00:00Z\",\"timestamp\":1737331200},\"fpid\":\"breachAaBbCcDdEeFf0011\",\"source\":\"Analyst Research\",\"source_type\":\"Credential Stealer\",\"title\":\"Example Combo List 2025\"},\"cookies\":[{\"affected_domain\":\"example.com\",\"allow_subdomains\":true,\"key\":\"auth-token-example\",\"path\":\"/login\",\"value\":\"I0gOkgC7KJlnrZXPPQYwGGEd1ZmeMhpQxo9example\"}],\"domain\":\"example.com\",\"email\":\"jdoe@example.com\",\"fpid\":\"aBcDeFgHiJkLmNoPqRsTuV\",\"header_\":{\"indexed_at\":1739001600},\"infected_host_attributes\":{\"fpid\":\"hostZzYyXxWw9988\",\"host_id\":\"DESKTOP-EXAMPLE01\",\"ip\":\"203.0.113.45\",\"ipv4\":\"203.0.113.45\",\"isp\":{\"autonomous_system_number\":64500,\"autonomous_system_organization\":\"EXAMPLE-AS\",\"connection_type\":\"Cable/DSL\",\"isp\":\"Example ISP\",\"organization\":\"Example ISP LLC\"},\"location\":{\"accuracy_radius\":50,\"city_name\":\"Exampleville\",\"continent_name\":\"North America\",\"country_name\":\"Exampleland\",\"latitude\":30.2672,\"location\":{\"lat\":30.2672,\"lon\":-97.7431},\"longitude\":-97.7431,\"subdivision_1_name\":\"Example State\"},\"machine\":{\"architecture\":\"x64\",\"language\":[\"en-US\"],\"os\":\"Windows 10\",\"user\":\"jdoe\"},\"malware\":{\"family\":\"ExampleStealer\",\"scanned_at\":{\"date-time\":\"2025-01-10T08:30:00Z\"},\"version\":\"1.2\"}},\"is_fresh\":true,\"last_observed_at\":{\"date-time\":\"2025-02-01T12:00:00Z\",\"timestamp\":1738411200},\"password\":\"P@ssw0rd123\",\"password_complexity\":{\"has_lowercase\":true,\"has_number\":true,\"has_symbol\":true,\"has_uppercase\":true,\"length\":11,\"probable_hash_algorithms\":[]},\"times_seen\":1,\"username\":\"jdoe@example.com\"}",
        "start": "2025-01-20T00:00:00.000Z",
        "type": [
            "indicator"
        ]
    },
    "host": {
        "architecture": "x64",
        "ip": [
            "203.0.113.45"
        ],
        "name": "DESKTOP-EXAMPLE01",
        "os": {
            "full": "Windows 10",
            "type": "windows"
        }
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "DESKTOP-EXAMPLE01",
            "example.com"
        ],
        "ip": [
            "203.0.113.45"
        ],
        "user": [
            "jdoe@example.com"
        ]
    },
    "source": {
        "as": {
            "number": 64500,
            "organization": {
                "name": "EXAMPLE-AS"
            }
        },
        "geo": {
            "city_name": "Exampleville",
            "continent_name": "North America",
            "country_name": "Exampleland",
            "location": {
                "lat": 30.2672,
                "lon": -97.7431
            },
            "region_name": "Example State"
        },
        "ip": "203.0.113.45"
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "ti_flashpoint-sighting"
    ],
    "threat": {
        "software": {
            "name": "ExampleStealer"
        }
    },
    "ti_flashpoint": {
        "sighting": {
            "affected_domain": "example.com",
            "basetypes": [
                "credential-sighting"
            ],
            "body": "jdoe@example.com:P@ssw0rd123",
            "breach": {
                "basetypes": [
                    "breach"
                ],
                "breach_type": "credential",
                "created_at": {
                    "date_time": "2025-01-15T00:00:00.000Z",
                    "timestamp": "2025-01-15T00:00:00.000Z"
                },
                "first_observed_at": {
                    "date_time": "2025-01-20T00:00:00.000Z",
                    "timestamp": "2025-01-20T00:00:00.000Z"
                },
                "fpid": "breachAaBbCcDdEeFf0011",
                "source": "Analyst Research",
                "source_type": "Credential Stealer",
                "title": "Example Combo List 2025"
            },
            "cookies": [
                {
                    "affected_domain": "example.com",
                    "allow_subdomains": true,
                    "key": "auth-token-example",
                    "path": "/login",
                    "value": "I0gOkgC7KJlnrZXPPQYwGGEd1ZmeMhpQxo9example"
                }
            ],
            "fpid": "aBcDeFgHiJkLmNoPqRsTuV",
            "infected_host_attributes": {
                "fpid": "hostZzYyXxWw9988",
                "host_id": "DESKTOP-EXAMPLE01",
                "ip": "203.0.113.45",
                "ipv4": "203.0.113.45",
                "isp": {
                    "autonomous_system_number": 64500,
                    "autonomous_system_organization": "EXAMPLE-AS",
                    "connection_type": "Cable/DSL",
                    "isp": "Example ISP",
                    "organization": "Example ISP LLC"
                },
                "location": {
                    "accuracy_radius": 50,
                    "city_name": "Exampleville",
                    "continent_name": "North America",
                    "country_name": "Exampleland",
                    "latitude": 30.2672,
                    "location": {
                        "lat": 30.2672,
                        "lon": -97.7431
                    },
                    "longitude": -97.7431,
                    "subdivision_1_name": "Example State"
                },
                "machine": {
                    "architecture": "x64",
                    "language": [
                        "en-US"
                    ],
                    "os": "Windows 10",
                    "user": "jdoe"
                },
                "malware": {
                    "family": "ExampleStealer",
                    "scanned_at": {
                        "date_time": "2025-01-10T08:30:00.000Z"
                    },
                    "version": "1.2"
                }
            },
            "is_fresh": true,
            "last_observed_at": {
                "date_time": "2025-02-01T12:00:00.000Z",
                "timestamp": "2025-02-01T12:00:00.000Z"
            },
            "password": "P@ssw0rd123",
            "password_complexity": {
                "has_lowercase": true,
                "has_number": true,
                "has_symbol": true,
                "has_uppercase": true,
                "length": 11
            },
            "times_seen": 1
        }
    },
    "url": {
        "domain": "sso.example.com",
        "full": "https://sso.example.com/login",
        "original": "https://sso.example.com/login",
        "path": "/login",
        "scheme": "https"
    },
    "user": {
        "domain": "example.com",
        "email": "jdoe@example.com",
        "name": "jdoe@example.com"
    }
}

{
    "@timestamp": "2025-02-08T08:00:00.000Z",
    "agent": {
        "ephemeral_id": "d394f23e-1af4-48e7-8d80-d5a5b599e486",
        "id": "095e5b4d-4c90-4287-ab46-46a1c17d830f",
        "name": "elastic-agent-38660",
        "type": "filebeat",
        "version": "8.19.0"
    },
    "data_stream": {
        "dataset": "ti_flashpoint.breach",
        "namespace": "24779",
        "type": "logs"
    },
    "ecs": {
        "version": "9.3.0"
    },
    "elastic_agent": {
        "id": "095e5b4d-4c90-4287-ab46-46a1c17d830f",
        "snapshot": false,
        "version": "8.19.0"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "created": "2025-01-15T00:00:00.000Z",
        "dataset": "ti_flashpoint.breach",
        "ingested": "2026-10-19T14:16:26Z",
        "kind": "event",
        "original": "{\"basetypes\":[\"breach\"],\"breach_type\":\"credential\",\"created_at\":{\"date-time\":\"2025-01-15T00:00:00Z\",\"timestamp\":1736899200},\"first_observed_at\":{\"date-time\":\"2025-01-20T00:00:00Z\",\"timestamp\":1737331200},\"fpid\":\"breachAaBbCcDdEeFf0011\",\"header_\":{\"indexed_at\":1739001600},\"new_records\":500,\"old_records\":11500,\"source\":\"Analyst Research\",\"source_type\":\"Credential Stealer\",\"title\":\"Example Combo List 2025\",\"top_domains\":[\"example.com\",\"example.org\",\"example.net\"],\"top_passwords\":[\"123456\",\"password\",\"qwerty\"],\"total_records\":15000,\"unique_records\":12000}",
        "start": "2025-01-20T00:00:00.000Z",
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "hosts": [
            "example.com",
            "example.org",
            "example.net"
        ]
    },
    "tags": [
        "preserve_original_event",
        "forwarded",
        "ti_flashpoint-breach"
    ],
    "ti_flashpoint": {
        "breach": {
            "basetypes": [
                "breach"
            ],
            "breach_type": "credential",
            "created_at": {
                "date_time": "2025-01-15T00:00:00.000Z",
                "timestamp": "2025-01-15T00:00:00.000Z"
            },
            "first_observed_at": {
                "date_time": "2025-01-20T00:00:00.000Z",
                "timestamp": "2025-01-20T00:00:00.000Z"
            },
            "fpid": "breachAaBbCcDdEeFf0011",
            "new_records": 500,
            "old_records": 11500,
            "source": "Analyst Research",
            "source_type": "Credential Stealer",
            "title": "Example Combo List 2025",
            "top_domains": [
                "example.com",
                "example.org",
                "example.net"
            ],
            "top_passwords": [
                "123456",
                "password",
                "qwerty"
            ],
            "total_records": 15000,
            "unique_records": 12000
        }
    }
}