{
    "@timestamp": "2024-05-09T12:24:05.286Z",
    "agent": {
        "ephemeral_id": "b0d47395-89bd-40e7-8018-57fdcc0cf1b8",
        "id": "013c7177-2e5d-40da-9e17-9ee5d2249880",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.12.2"
    },
    "data_stream": {
        "dataset": "ti_recordedfuture.threat",
        "namespace": "ep",
        "type": "logs"
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "013c7177-2e5d-40da-9e17-9ee5d2249880",
        "snapshot": false,
        "version": "8.12.2"
    },
    "event": {
        "agent_id_status": "verified",
        "category": [
            "threat"
        ],
        "dataset": "ti_recordedfuture.threat",
        "ingested": "2024-05-09T12:24:15Z",
        "kind": "enrichment",
        "risk_score": 75,
        "timezone": "+00:00",
        "type": [
            "indicator"
        ]
    },
    "input": {
        "type": "log"
    },
    "log": {
        "file": {
            "path": "/tmp/service_logs/rf_file_default.csv"
        },
        "offset": 57
    },
    "recordedfuture": {
        "evidence_details": [
            {
                "criticality": 2,
                "criticality_label": "Suspicious",
                "evidence_string": "2 sightings on 1 source: PolySwarm. Most recent link (Mar 23, 2024): https://polyswarm.network/scan/results/file/63212aa8c94098a844945ed1611389b2e1c9dc3906a5ba9d7d0d320344213f4f",
                "mitigation_string": "",
                "name": "linkedToMalware",
                "rule": "Linked to Malware",
                "sightings_count": 2,
                "sources": [
                    "source:doLlw5"
                ],
                "sources_count": 1,
                "timestamp": "2024-03-23T17:10:20.642Z"
            },
            {
                "criticality": 3,
                "criticality_label": "Malicious",
                "evidence_string": "3 sightings on 3 sources: Polyswarm Sandbox Analysis, Recorded Future Triage Malware Analysis, PolySwarm. Most recent link (Mar 23, 2024): https://polyswarm.network/scan/results/file/63212aa8c94098a844945ed1611389b2e1c9dc3906a5ba9d7d0d320344213f4f",
                "mitigation_string": "",
                "name": "positiveMalwareVerdict",
                "rule": "Positive Malware Verdict",
                "sightings_count": 3,
                "sources": [
                    "source:hzRhwZ",
                    "source:ndy5_2",
                    "source:doLlw5"
                ],
                "sources_count": 3,
                "timestamp": "2024-03-23T16:36:02.000Z"
            }
        ],
        "name": "63212aa8c94098a844945ed1611389b2e1c9dc3906a5ba9d7d0d320344213f4f",
        "risk_string": "2/17"
    },
    "tags": [
        "forwarded",
        "recordedfuture"
    ],
    "threat": {
        "feed": {
            "name": "Recorded Future"
        },
        "indicator": {
            "file": {
                "hash": {
                    "sha256": "63212aa8c94098a844945ed1611389b2e1c9dc3906a5ba9d7d0d320344213f4f"
                }
            },
            "provider": [
                "PolySwarm",
                "Polyswarm Sandbox Analysis",
                "Recorded Future Triage Malware Analysis"
            ],
            "scanner_stats": 4,
            "sightings": 5,
            "type": "file"
        }
    }
}