/
SCRANTON_dns.log
32 lines (32 loc) · 15.5 KB
/
SCRANTON_dns.log
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588205198.89971,"uid":"Cw1Hz43UWS4qXFei8f","id_orig_h":"10.0.1.4","id_orig_p":64842,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":8564,"rtt":0.0015780925750732422,"query":"newyork.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["10.0.0.4"],"TTLs":[3600.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588205279.132979,"uid":"CCworw1fI2gPWTcRR2","id_orig_h":"10.0.1.4","id_orig_p":58559,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":51878,"query":"wpad.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588205698.070391,"uid":"ChyMIt1tu6vYfNiqah","id_orig_h":"10.0.1.4","id_orig_p":52650,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":10001,"rtt":0.0018830299377441406,"query":"wec.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["10.0.1.10"],"TTLs":[1200.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588205879.148441,"uid":"C3e0sk3qh5MfMFTio8","id_orig_h":"10.0.1.4","id_orig_p":63470,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":26811,"query":"wpad.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206258.96479,"uid":"CBztTh4A8dzyIelZTl","id_orig_h":"10.0.1.4","id_orig_p":62149,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":44844,"rtt":0.001786947250366211,"query":"_ldap._tcp.pdc._msdcs.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":33,"qtype_name":"SRV","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["newyork.dmevals.local"],"TTLs":[600.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206479.163224,"uid":"C0ch1M1Oka8xzF0cR4","id_orig_h":"10.0.1.4","id_orig_p":64670,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":19300,"query":"wpad.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.258622,"uid":"CurNJl2BxHDMUxH7j7","id_orig_h":"10.0.1.4","id_orig_p":60981,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":22325,"rtt":0.04760003089904785,"query":"fp-vp.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["fp-vp.ec.azureedge.net","cs9.wpc.v0cdn.net","72.21.81.200"],"TTLs":[1800.0,3600.0,3600.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.330598,"uid":"C0LmMn33GTjEqE0YKc","id_orig_h":"10.0.1.4","id_orig_p":50051,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":23711,"rtt":0.0324859619140625,"query":"3074e7e2454df28df9719b81225d57b0.clo.footprintdns.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["geo.trafficmanager.net","bl2prdapp01-canary.cloudapp.net","168.62.51.225"],"TTLs":[30.0,300.0,60.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.388797,"uid":"CiFhtR3lU5do8dSNfc","id_orig_h":"10.0.1.4","id_orig_p":58377,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":535,"rtt":0.03494000434875488,"query":"fp-afd.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["fp-afd.afd.azureedge.net","afd.t-0001.t-msedge.net","t-0001.t-msedge.net","edge-prod-bl2r3.ctrl.t-0001.t-msedge.net","standard.t-0001.t-msedge.net","13.107.246.10"],"TTLs":[1800.0,300.0,240.0,60.0,240.0,240.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.284807,"uid":"CurNJl2BxHDMUxH7j7","id_orig_h":"10.0.1.4","id_orig_p":60981,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":22325,"query":"fp-vp.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.347199,"uid":"C0LmMn33GTjEqE0YKc","id_orig_h":"10.0.1.4","id_orig_p":50051,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":23711,"query":"3074e7e2454df28df9719b81225d57b0.clo.footprintdns.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206484.409798,"uid":"CiFhtR3lU5do8dSNfc","id_orig_h":"10.0.1.4","id_orig_p":58377,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":535,"query":"fp-afd.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206680.723203,"uid":"CHvY1N3JjYnfkx4By7","id_orig_h":"10.0.1.4","id_orig_p":57463,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":47429,"rtt":0.11652708053588867,"query":"go.microsoft.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["go.microsoft.com.edgekey.net","e11290.dspg.akamaiedge.net","23.195.139.83"],"TTLs":[1021.0,599.0,19.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206681.188716,"uid":"CcJZUK3UkHCTgwZ5jd","id_orig_h":"10.0.1.4","id_orig_p":61632,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":59692,"rtt":0.010836124420166016,"query":"onegetcdn.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["onegetcdn.ec.azureedge.net","cs9.wpc.v0cdn.net","72.21.81.200"],"TTLs":[1800.0,3600.0,3403.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206680.753785,"uid":"CHvY1N3JjYnfkx4By7","id_orig_h":"10.0.1.4","id_orig_p":57463,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":47429,"query":"go.microsoft.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206721.506791,"uid":"CnyW3pEzppr24ZM44","id_orig_h":"10.0.1.4","id_orig_p":58496,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":40822,"rtt":0.07015085220336914,"query":"www.powershellgallery.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["powershellgallerytrafficmanager.trafficmanager.net","psg-prod-eastus.cloudapp.net","40.87.85.101"],"TTLs":[3599.0,29.0,9.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206724.00956,"uid":"CKmOLH1V5WEtbZBbv6","id_orig_h":"10.0.1.4","id_orig_p":63642,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":55093,"rtt":0.009566783905029297,"query":"psg-prod-eastus.azureedge.net","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["psg-prod-eastus.ec.azureedge.net","cs9.wpc.v0cdn.net","72.21.81.200"],"TTLs":[1799.0,3599.0,3360.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206721.537517,"uid":"CnyW3pEzppr24ZM44","id_orig_h":"10.0.1.4","id_orig_p":58496,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":40822,"query":"www.powershellgallery.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206764.196229,"uid":"CLNoEiaU0vBUTXvnc","id_orig_h":"10.0.1.4","id_orig_p":56697,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":30380,"rtt":0.03545713424682617,"query":"www.bing.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["a-0001.a-afdentry.net.trafficmanager.net","dual-a-0001.a-msedge.net","204.79.197.200","13.107.21.200"],"TTLs":[1035.0,59.0,59.0,59.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206764.220436,"uid":"CLNoEiaU0vBUTXvnc","id_orig_h":"10.0.1.4","id_orig_p":56697,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":30380,"query":"www.bing.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206776.376547,"uid":"Ct4Zj125sjkzdcnH16","id_orig_h":"10.0.1.4","id_orig_p":51267,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":40806,"rtt":0.003885984420776367,"query":"v10.events.data.microsoft.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["global.asimov.events.data.trafficmanager.net","skypedataprdcolneu01.cloudapp.net","52.114.76.37"],"TTLs":[1170.0,31.0,10.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206806.294795,"uid":"CKmf4S2bl9CGe5pL3l","id_orig_h":"10.0.1.4","id_orig_p":51183,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":3216,"rtt":0.00144195556640625,"query":"nashua.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["10.0.1.6"],"TTLs":[1200.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206836.61553,"uid":"CgEqvP3Bx3Ovu5mIZg","id_orig_h":"10.0.1.4","id_orig_p":56970,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":61247,"rtt":0.0016510486602783203,"query":"ctldl.windowsupdate.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["audownload.windowsupdate.nsatc.net","au.download.windowsupdate.com.edgesuite.net","a767.dscg3.akamai.net","a767.dscg3.akamai.net.0.1.cn.akamaitech.net","23.215.102.162","23.215.102.186"],"TTLs":[3587.0,587.0,887.0,7.0,7.0,7.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206901.871176,"uid":"CyvoQK1QVS0Gxz87a5","id_orig_h":"10.0.1.4","id_orig_p":64348,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":6114,"query":"_ldap._tcp.default-first-site-name._sites.dc._msdcs.scranton.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":33,"qtype_name":"SRV","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206901.873282,"uid":"CYR2NUZHccxJMoKSi","id_orig_h":"10.0.1.4","id_orig_p":55870,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":4810,"query":"_ldap._tcp.dc._msdcs.scranton.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":33,"qtype_name":"SRV","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206904.408294,"uid":"C3BlmB3Q0vWUARk4G8","id_orig_h":"10.0.1.4","id_orig_p":58799,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":49582,"rtt":0.0012409687042236328,"query":"_ldap._tcp.pdc._msdcs.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":33,"qtype_name":"SRV","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["newyork.dmevals.local"],"TTLs":[600.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206901.874608,"uid":"CA7VpA3jbDFtNCYt32","id_orig_h":"10.0.1.4","id_orig_p":137,"id_resp_h":"10.0.1.255","id_resp_p":137,"proto":"udp","trans_id":46522,"query":"SCRANTON","qclass":1,"qclass_name":"C_INTERNET","qtype":32,"qtype_name":"NB","AA":false,"TC":false,"RD":true,"RA":false,"Z":1,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206902.639285,"uid":"CA7VpA3jbDFtNCYt32","id_orig_h":"10.0.1.4","id_orig_p":137,"id_resp_h":"10.0.1.255","id_resp_p":137,"proto":"udp","trans_id":46522,"query":"SCRANTON","qclass":1,"qclass_name":"C_INTERNET","qtype":32,"qtype_name":"NB","AA":false,"TC":false,"RD":true,"RA":false,"Z":1,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206903.399814,"uid":"CA7VpA3jbDFtNCYt32","id_orig_h":"10.0.1.4","id_orig_p":137,"id_resp_h":"10.0.1.255","id_resp_p":137,"proto":"udp","trans_id":46522,"query":"SCRANTON","qclass":1,"qclass_name":"C_INTERNET","qtype":32,"qtype_name":"NB","AA":false,"TC":false,"RD":true,"RA":false,"Z":1,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588206925.234118,"uid":"CBIm9F1x1dKwNMjezi","id_orig_h":"10.0.1.4","id_orig_p":60073,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":35264,"rtt":0.0010280609130859375,"query":"wec.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":true,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["10.0.1.10"],"TTLs":[1200.0],"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588207079.169839,"uid":"CSY75A4aVt69mgc1a9","id_orig_h":"10.0.1.4","id_orig_p":56002,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":1454,"query":"wpad.dmevals.local","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":3,"rcode_name":"NXDOMAIN","AA":false,"TC":false,"RD":true,"RA":false,"Z":0,"rejected":false}
{"@stream":"dns","@system":"simplerockbuild.simplerock.lan","@proc":"zeek","ts":1588207195.956719,"uid":"CRtwfX2WZXZU5xaUvi","id_orig_h":"10.0.1.4","id_orig_p":59978,"id_resp_h":"10.0.0.4","id_resp_p":53,"proto":"udp","trans_id":14829,"rtt":0.026455163955688477,"query":"arc.msn.com","qclass":1,"qclass_name":"C_INTERNET","qtype":1,"qtype_name":"A","rcode":0,"rcode_name":"NOERROR","AA":false,"TC":false,"RD":true,"RA":true,"Z":0,"answers":["arc.msn.com.nsatc.net","52.179.129.229"],"TTLs":[3599.0,299.0],"rejected":false}