{"code":200,"message":"success","data":{"alerts":{"generatedAt":"2026-10-21 21:38:35","cacheSeconds":45,"dataSource":{"wazuhMode":"REAL","degraded":false,"note":"网络告警（Suricata）经 Wazuh agent 采集后随 indexer 一起返回，来源已按规则分组判定"},"windowSize":200,"rawTotal":200,"total":18,"aggregated":true,"windowMinutes":5,"list":[{"aggId":"agg-4a41ad30f8fe","count":7,"startTime":"2026-10-21 21:37:40","endTime":"2026-10-21 21:38:32","title":"蜜罐: 攻击者\"登录成功\" 用户=vigilant 口令=[口令已隐藏] 来源=163.5.210.194","ruleName":"蜜罐: 攻击者\"登录成功\" 用户=vigilant 口令=[口令已隐藏] 来源=163.5.210.194","attck":null,"srcIp":"163.5.210.194","srcGeo":null,"occurredAt":"2026-10-21 21:38:10","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-a9c068469d6f","count":42,"startTime":"2026-10-21 21:37:24","endTime":"2026-10-21 21:38:32","title":"Suricata: Alert - XK-LAB inbound connection to database port (lab exposes no public DB)","ruleName":"Suricata: Alert - XK-LAB inbound connection to database port (lab exposes no public DB)","attck":null,"srcIp":"46.99.134.36","srcGeo":null,"occurredAt":"2026-10-21 21:38:32","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"OTHER","typeLabel":"其他","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-514330b30a42","count":45,"startTime":"2026-10-21 21:37:20","endTime":"2026-10-21 21:38:32","title":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20","ruleName":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20","attck":null,"srcIp":"193.32.162.20","srcGeo":null,"occurredAt":"2026-10-21 21:38:30","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-188e93bb3980","count":40,"startTime":"2026-10-21 21:37:22","endTime":"2026-10-21 21:38:32","title":"XK-LAB: 蜜罐 MSSQL 收到登录凭据尝试（已进入认证阶段）来源=46.99.134.36 用户凭据=[已隐藏]","ruleName":"XK-LAB: 蜜罐 MSSQL 收到登录凭据尝试（已进入认证阶段）来源=46.99.134.36 用户凭据=[已隐藏]","attck":null,"srcIp":"46.99.134.36","srcGeo":null,"occurredAt":"2026-10-21 21:38:32","status":"ACTIVE","hitCount":1,"severity":"CRITICAL","severityLabel":"严重","type":"SQL_INJECTION","typeLabel":"SQL注入","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-e2df02434d35","count":27,"startTime":"2026-10-21 21:37:22","endTime":"2026-10-21 21:38:32","title":"蜜罐: 攻击者\"登录成功\" 用户=admin 口令=[口令已隐藏] 来源=5.231.242.53","ruleName":"蜜罐: 攻击者\"登录成功\" 用户=admin 口令=[口令已隐藏] 来源=5.231.242.53","attck":null,"srcIp":"5.231.242.53","srcGeo":null,"occurredAt":"2026-10-21 21:38:24","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-bfcb15297642","count":15,"startTime":"2026-10-21 21:37:22","endTime":"2026-10-21 21:38:28","title":"XK-LAB: 同一来源 5 分钟内蜜罐 SSH 会话 >=20 次（自动化爆破/刮削）来源=193.32.162.20","ruleName":"XK-LAB: 同一来源 5 分钟内蜜罐 SSH 会话 >=20 次（自动化爆破/刮削）来源=193.32.162.20","attck":null,"srcIp":"193.32.162.20","srcGeo":null,"occurredAt":"2026-10-21 21:37:40","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"BRUTE_FORCE","typeLabel":"暴力破解","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-0e8926e6decc","count":3,"startTime":"2026-10-21 21:38:26","endTime":"2026-10-21 21:38:26","title":"蜜罐: 攻击者\"登录成功\" 用户=jak 口令=[口令已隐藏] 来源=123.54.215.74","ruleName":"蜜罐: 攻击者\"登录成功\" 用户=jak 口令=[口令已隐藏] 来源=123.54.215.74","attck":null,"srcIp":"123.54.215.74","srcGeo":null,"occurredAt":"2026-10-21 21:38:26","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-32f147aee1ca","count":1,"startTime":"2026-10-21 21:38:26","endTime":"2026-10-21 21:38:26","title":"Suricata: Alert - XK-LAB SSH client fingerprint libssh/libssh2 (automated bruteforce toolchain)","ruleName":"Suricata: Alert - XK-LAB SSH client fingerprint libssh/libssh2 (automated bruteforce toolchain)","attck":{"id":"T1110","name":"暴力破解","label":"Brute Force"},"srcIp":"213.225.7.250","srcGeo":null,"occurredAt":"2026-10-21 21:38:26","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"BRUTE_FORCE","typeLabel":"暴力破解","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-b9aef0fe5dcc","count":3,"startTime":"2026-10-21 21:38:24","endTime":"2026-10-21 21:38:26","title":"蜜罐: 攻击者\"登录成功\" 用户=testuser 口令=[口令已隐藏] 来源=213.225.7.250","ruleName":"蜜罐: 攻击者\"登录成功\" 用户=testuser 口令=[口令已隐藏] 来源=213.225.7.250","attck":null,"srcIp":"213.225.7.250","srcGeo":null,"occurredAt":"2026-10-21 21:38:26","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-cf61981e39e1","count":1,"startTime":"2026-10-21 21:38:26","endTime":"2026-10-21 21:38:26","title":"Suricata: Alert - XK-LAB SSH client fingerprint libssh/libssh2 (automated bruteforce toolchain)","ruleName":"Suricata: Alert - XK-LAB SSH client fingerprint libssh/libssh2 (automated bruteforce toolchain)","attck":{"id":"T1110","name":"暴力破解","label":"Brute Force"},"srcIp":"123.54.215.74","srcGeo":null,"occurredAt":"2026-10-21 21:38:26","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"BRUTE_FORCE","typeLabel":"暴力破解","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-8055fa4baf83","count":9,"startTime":"2026-10-21 21:37:24","endTime":"2026-10-21 21:38:24","title":"XK-LAB: 同一来源 5 分钟内蜜罐 SSH 会话 >=20 次（自动化爆破/刮削）来源=5.231.242.53","ruleName":"XK-LAB: 同一来源 5 分钟内蜜罐 SSH 会话 >=20 次（自动化爆破/刮削）来源=5.231.242.53","attck":null,"srcIp":"5.231.242.53","srcGeo":null,"occurredAt":"2026-10-21 21:37:34","status":"ACTIVE","hitCount":1,"severity":"HIGH","severityLabel":"高危","type":"BRUTE_FORCE","typeLabel":"暴力破解","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-26b645582bb1","count":1,"startTime":"2026-10-21 21:38:06","endTime":"2026-10-21 21:38:06","title":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","ruleName":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","attck":null,"srcIp":"163.5.210.194","srcGeo":null,"occurredAt":"2026-10-21 21:38:06","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"SCAN","typeLabel":"扫描探测","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-abf527d7f800","count":1,"startTime":"2026-10-21 21:37:56","endTime":"2026-10-21 21:37:56","title":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","ruleName":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","attck":null,"srcIp":"5.231.242.53","srcGeo":null,"occurredAt":"2026-10-21 21:37:56","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"SCAN","typeLabel":"扫描探测","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-dbad97ac90b0","count":1,"startTime":"2026-10-21 21:37:54","endTime":"2026-10-21 21:37:54","title":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","ruleName":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","attck":null,"srcIp":"46.99.134.36","srcGeo":null,"occurredAt":"2026-10-21 21:37:54","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"SCAN","typeLabel":"扫描探测","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-8bef61ea8239","count":1,"startTime":"2026-10-21 21:37:52","endTime":"2026-10-21 21:37:52","title":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","ruleName":"Suricata: Alert - XK-LAB multi-decoy-port sweep from single source (>=3 hits/60s)","attck":null,"srcIp":"193.32.162.20","srcGeo":null,"occurredAt":"2026-10-21 21:37:52","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"SCAN","typeLabel":"扫描探测","source":"SURICATA","sourceLabel":"Suricata 网络告警"},{"aggId":"agg-ea010bba1128","count":1,"startTime":"2026-10-21 21:37:49","endTime":"2026-10-21 21:37:49","title":"PAM: Login session closed.","ruleName":"PAM: Login session closed.","attck":null,"srcIp":"未知","srcGeo":null,"occurredAt":"2026-10-21 21:37:49","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-00926926a85d","count":1,"startTime":"2026-10-21 21:37:49","endTime":"2026-10-21 21:37:49","title":"sshd: authentication success.","ruleName":"sshd: authentication success.","attck":null,"srcIp":"43.143.114.79","srcGeo":null,"occurredAt":"2026-10-21 21:37:49","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"},{"aggId":"agg-eb0f5a251b2c","count":1,"startTime":"2026-10-21 21:37:49","endTime":"2026-10-21 21:37:49","title":"PAM: Login session opened.","ruleName":"PAM: Login session opened.","attck":null,"srcIp":"未知","srcGeo":null,"occurredAt":"2026-10-21 21:37:49","status":"ACTIVE","hitCount":1,"severity":"LOW","severityLabel":"低危","type":"OTHER","typeLabel":"其他","source":"WAZUH","sourceLabel":"Wazuh 主机告警"}],"stats":{"bySource":[{"key":"WAZUH","label":"Wazuh 主机告警","count":121},{"key":"SURICATA","label":"Suricata 网络告警","count":79},{"key":"BUILTIN","label":"内置样本","count":0}],"byType":[{"key":"BRUTE_FORCE","label":"暴力破解","count":27},{"key":"SQL_INJECTION","label":"SQL注入","count":39},{"key":"SCAN","label":"扫描探测","count":4},{"key":"OTHER","label":"其他","count":130}],"trend":[{"time":"22:00","count":0},{"time":"23:00","count":0},{"time":"00:00","count":0},{"time":"01:00","count":0},{"time":"02:00","count":0},{"time":"03:00","count":0},{"time":"04:00","count":0},{"time":"05:00","count":0},{"time":"06:00","count":0},{"time":"07:00","count":0},{"time":"08:00","count":0},{"time":"09:00","count":0},{"time":"10:00","count":0},{"time":"11:00","count":0},{"time":"12:00","count":0},{"time":"13:00","count":0},{"time":"14:00","count":0},{"time":"15:00","count":0},{"time":"16:00","count":0},{"time":"17:00","count":0},{"time":"18:00","count":0},{"time":"19:00","count":0},{"time":"20:00","count":0},{"time":"21:00","count":200}],"bySeverity":[{"key":"CRITICAL","label":"严重","count":32},{"key":"HIGH","label":"高危","count":30},{"key":"MEDIUM","label":"中危","count":2},{"key":"LOW","label":"低危","count":136},{"key":"INFO","label":"提示","count":0}]},"stats24h":{"available":true,"total":157466,"bySeverity":{"CRITICAL":4501,"HIGH":37944,"MEDIUM":1276,"LOW":113745,"INFO":0},"trend":[{"time":"21:00","count":1442},{"time":"22:00","count":4000},{"time":"23:00","count":4161},{"time":"00:00","count":4287},{"time":"01:00","count":4390},{"time":"02:00","count":5021},{"time":"03:00","count":13203},{"time":"04:00","count":13845},{"time":"05:00","count":13802},{"time":"06:00","count":4641},{"time":"07:00","count":5088},{"time":"08:00","count":6475},{"time":"09:00","count":4377},{"time":"10:00","count":4863},{"time":"11:00","count":5813},{"time":"12:00","count":5849},{"time":"13:00","count":6139},{"time":"14:00","count":7000},{"time":"15:00","count":6015},{"time":"16:00","count":5960},{"time":"17:00","count":5856},{"time":"18:00","count":5828},{"time":"19:00","count":5613},{"time":"20:00","count":6415},{"time":"21:00","count":7383}],"windowHours":24,"state":"ok","reason":"OK","note":"24 小时聚合已取到（按 @timestamp 时间范围聚合，不受取数窗口影响）"},"stats24hState":"ok","stats24hReason":"OK","ipDisclosure":{"masked":false,"notice":"观测到的来源地址，未经验证，仅供参考","removalContact":"https://xiaokeqing.cn/"}},"geo":{"generatedAt":"2026-10-21 21:38:40","available":true,"reason":"OK","geoSource":"DB-IP Lite City 2026-10 + DB-IP Lite ASN 2026-10","geoAttribution":"IP 地理位置数据由 DB-IP (https://db-ip.com) 提供，CC BY 4.0","window":"24h","thresholds":{"minCount":3,"minSharePercent":1.0,"topCountries":20,"topProvincesPerCountry":10,"topAsns":10},"coverage":{"totalAlerts":157471,"withSourceIp":156169,"geocoded":154344,"excludedSelf":964,"excludedInternal":861,"excludedReserved":0,"unlocated":0,"invalid":0,"sourceBuckets":705,"sourceBucketsTruncated":false},"countryCount":8,"provinceCountCN":0,"knownProvinceCount":158,"byCountry":[{"country":"NL","countryName":"荷兰","count":94558,"uniqueIps":47,"sharePercent":61.26,"byProvince":[{"province":"North Holland","count":76703,"uniqueIps":40},{"province":"Limburg","count":17853,"uniqueIps":5}]},{"country":"FR","countryName":"法国","count":17648,"uniqueIps":20,"sharePercent":11.43,"byProvince":[{"province":"Occitanie","count":12770,"uniqueIps":1},{"province":"Provence-Alpes-Côte d'Azur","count":4666,"uniqueIps":1}]},{"country":"SG","countryName":"新加坡","count":17645,"uniqueIps":11,"sharePercent":11.43,"byProvince":[{"province":"未知","count":17645,"uniqueIps":11}]},{"country":"IN","countryName":"印度","count":9430,"uniqueIps":24,"sharePercent":6.11,"byProvince":[{"province":"Karnataka","count":9092,"uniqueIps":6}]},{"country":"XK","countryName":"XK","count":3668,"uniqueIps":1,"sharePercent":2.38,"byProvince":[{"province":"Pristina","count":3668,"uniqueIps":1}]},{"country":"CN","countryName":"中国","count":3002,"uniqueIps":90,"sharePercent":1.95,"byProvince":[]},{"country":"PK","countryName":"巴基斯坦","count":2827,"uniqueIps":1,"sharePercent":1.83,"byProvince":[{"province":"Punjab","count":2827,"uniqueIps":1}]},{"country":"US","countryName":"美国","count":1555,"uniqueIps":252,"sharePercent":1.01,"byProvince":[]}],"byProvinceCN":[],"byAsnTop":[{"asn":47890,"org":"UNMANAGED LTD","count":76145,"uniqueIps":8},{"asn":14061,"org":"DigitalOcean, LLC","count":26721,"uniqueIps":26},{"asn":49581,"org":"Ferdinand Zink trading as Tube-Hosting","count":17849,"uniqueIps":2},{"asn":399486,"org":"12651980 CANADA INC.","count":12770,"uniqueIps":1},{"asn":214961,"org":"Stellar Group SAS","count":4666,"uniqueIps":1},{"asn":21246,"org":"IPKO Telecommunications LLC","count":3668,"uniqueIps":1},{"asn":142647,"org":"Nasstec Airnet Networks Private Limited","count":2827,"uniqueIps":1}],"trend":[{"ts":"2026-10-20T21:00","count":1407},{"ts":"2026-10-20T22:00","count":3924},{"ts":"2026-10-20T23:00","count":4109},{"ts":"2026-10-21T00:00","count":4231},{"ts":"2026-10-21T01:00","count":4338},{"ts":"2026-10-21T02:00","count":4969},{"ts":"2026-10-21T03:00","count":13149},{"ts":"2026-10-21T04:00","count":13793},{"ts":"2026-10-21T05:00","count":13746},{"ts":"2026-10-21T06:00","count":4589},{"ts":"2026-10-21T07:00","count":5038},{"ts":"2026-10-21T08:00","count":6421},{"ts":"2026-10-21T09:00","count":4313},{"ts":"2026-10-21T10:00","count":4811},{"ts":"2026-10-21T11:00","count":5761},{"ts":"2026-10-21T12:00","count":5797},{"ts":"2026-10-21T13:00","count":6087},{"ts":"2026-10-21T14:00","count":6947},{"ts":"2026-10-21T15:00","count":5963},{"ts":"2026-10-21T16:00","count":5909},{"ts":"2026-10-21T17:00","count":5804},{"ts":"2026-10-21T18:00","count":5776},{"ts":"2026-10-21T19:00","count":5561},{"ts":"2026-10-21T20:00","count":6363},{"ts":"2026-10-21T21:00","count":7363}],"byCountryHour":{"available":true,"reason":null,"hours":["2026-10-20T21:00","2026-10-20T22:00","2026-10-20T23:00","2026-10-21T00:00","2026-10-21T01:00","2026-10-21T02:00","2026-10-21T03:00","2026-10-21T04:00","2026-10-21T05:00","2026-10-21T06:00","2026-10-21T07:00","2026-10-21T08:00","2026-10-21T09:00","2026-10-21T10:00","2026-10-21T11:00","2026-10-21T12:00","2026-10-21T13:00","2026-10-21T14:00","2026-10-21T15:00","2026-10-21T16:00","2026-10-21T17:00","2026-10-21T18:00","2026-10-21T19:00","2026-10-21T20:00"],"series":[{"country":"NL","counts":[1101,3064,3118,3209,3241,3370,3261,3261,3313,3317,3279,3288,3278,3184,4437,4678,4807,4820,4861,4916,5022,4974,4826,4876]},{"country":"SG","counts":[0,2,16,0,0,5,8479,9123,0,0,2,3,0,0,1,5,0,0,2,2,3,1,1,0]},{"country":"FR","counts":[249,692,711,753,821,837,880,863,869,879,859,866,851,916,834,798,772,791,500,515,536,537,509,498]},{"country":"IN","counts":[0,1,0,1,4,76,0,0,9004,48,20,0,0,60,101,0,0,51,32,3,7,4,6,7]},{"country":"PK","counts":[0,0,0,0,0,0,0,0,0,0,695,2132,0,0,0,0,0,0,0,0,0,0,0,0]},{"country":"CN","counts":[15,37,14,9,16,158,114,199,136,102,38,12,60,184,89,60,32,439,212,276,74,67,69,89]},{"country":"US","counts":[11,25,12,30,38,116,90,43,229,155,22,26,8,166,122,43,76,137,79,11,37,17,17,27]},{"country":"XK","counts":[0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,702]},{"country":"CL","counts":[0,0,136,116,116,120,116,24,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]},{"country":"KR","counts":[0,0,0,0,1,0,0,1,0,0,0,0,0,0,0,0,0,104,65,45,27,33,40,36]},{"country":"HK","counts":[0,0,0,0,0,160,32,48,0,4,10,0,0,2,2,0,0,80,0,0,0,0,0,0]},{"country":"ID","counts":[0,0,0,0,0,0,0,0,0,0,0,0,12,68,0,0,96,63,0,0,0,0,0,4]},{"country":"OTHER","counts":[6,19,33,33,34,43,111,156,107,12,30,26,18,165,81,143,219,395,143,59,31,58,27,40]}]},"note":"只给聚合：响应里不含任何 IP（连掩码 IP 都没有）、不含单条告警、不含内网资产。分母以 coverage 为准（totalAlerts 是窗口内全部告警，withSourceIp 才是画地图用的那批）；trend 是「带来源 IP 的告警」按本地时间的小时分桶（24 点）；入榜门槛 count>=3 且占比>=1.0%。IP 地理位置数据由 DB-IP (https://db-ip.com) 提供，CC BY 4.0","cacheSeconds":45,"ipDisclosure":{"masked":false,"notice":"观测到的来源地址，未经验证，仅供参考","removalContact":"https://xiaokeqing.cn/"}},"honeypot":{"generatedAt":"2026-10-21 21:38:39","cacheSeconds":45,"available":true,"commandsAvailable":false,"note":"IP 显示观测到的真实来源地址（内网/保留地址一律写作「内网/未知」）；口令只给结构，命令时间线的数据源尚未接入（Wazuh 侧没有命令执行规则，不编造）","total":10000,"connections":262,"logins":268,"loginFails":0,"sampled":800,"topCredentials":[{"key":"cchen / 7 位·特殊字符+非ASCII·弱口令","count":120,"username":"cchen","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"root / 7 位·特殊字符+非ASCII·弱口令","count":49,"username":"root","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"admin / 7 位·特殊字符+非ASCII·弱口令","count":24,"username":"admin","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"user / 7 位·特殊字符+非ASCII·弱口令","count":5,"username":"user","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"vie / 7 位·特殊字符+非ASCII·弱口令","count":5,"username":"vie","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"vigilant / 7 位·特殊字符+非ASCII·弱口令","count":3,"username":"vigilant","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"saif / 7 位·特殊字符+非ASCII·弱口令","count":2,"username":"saif","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"PUBLIC / 7 位·特殊字符+非ASCII·弱口令","count":2,"username":"PUBLIC","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"arkserver / 7 位·特殊字符+非ASCII·弱口令","count":2,"username":"arkserver","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true},{"key":"vigia / 7 位·特殊字符+非ASCII·弱口令","count":2,"username":"vigia","passwordLength":7,"passwordCharClasses":"特殊字符+非ASCII","weakPassword":true}],"topSources":[{"key":"193.32.162.20","count":240},{"key":"5.231.242.53","count":152},{"key":"163.5.210.194","count":50},{"key":"213.225.7.250","count":14},{"key":"120.48.112.221","count":14},{"key":"45.120.216.232","count":12},{"key":"123.54.215.74","count":10},{"key":"51.68.151.167","count":10},{"key":"122.51.69.213","count":10},{"key":"115.190.216.185","count":10}],"topClients":[{"key":"SSH-2.0-Go","count":196},{"key":"SSH-2.0-libssh_0.9.6","count":43},{"key":"SSH-2.0-OpenSSH","count":29},{"key":"SSH-2.0-libssh-0.2","count":1},{"key":"SSH-2.0-OpenSSH_7.4","count":1}],"timeline":[{"time":"2026-10-21 21:38:32","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 163.5.210.194"},{"time":"2026-10-21 21:38:32","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:32","kind":"客户端指纹","srcIp":"5.231.242.53","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=5.231.242.53"},{"time":"2026-10-21 21:38:32","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:32","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 5.231.242.53"},{"time":"2026-10-21 21:38:30","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:28","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:28","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:26","kind":"客户端指纹","srcIp":"123.54.215.74","detail":"蜜罐: SSH 客户端版本 SSH-2.0-libssh_0.9.6 来源=123.54.215.74"},{"time":"2026-10-21 21:38:26","kind":"登录成功","srcIp":"123.54.215.74","detail":"蜜罐: 攻击者\"登录成功\" 用户=jak 口令=[口令已隐藏] 来源=123.54.215.74"},{"time":"2026-10-21 21:38:26","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 123.54.215.74"},{"time":"2026-10-21 21:38:26","kind":"登录成功","srcIp":"213.225.7.250","detail":"蜜罐: 攻击者\"登录成功\" 用户=testuser 口令=[口令已隐藏] 来源=213.225.7.250"},{"time":"2026-10-21 21:38:24","kind":"客户端指纹","srcIp":"213.225.7.250","detail":"蜜罐: SSH 客户端版本 SSH-2.0-libssh_0.9.6 来源=213.225.7.250"},{"time":"2026-10-21 21:38:24","kind":"客户端指纹","srcIp":"5.231.242.53","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=5.231.242.53"},{"time":"2026-10-21 21:38:24","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:24","kind":"登录成功","srcIp":"5.231.242.53","detail":"蜜罐: 攻击者\"登录成功\" 用户=admin 口令=[口令已隐藏] 来源=5.231.242.53"},{"time":"2026-10-21 21:38:24","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 213.225.7.250"},{"time":"2026-10-21 21:38:22","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:22","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 5.231.242.53"},{"time":"2026-10-21 21:38:22","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:18","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:18","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:18","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:16","kind":"登录成功","srcIp":"5.231.242.53","detail":"蜜罐: 攻击者\"登录成功\" 用户=root 口令=[口令已隐藏] 来源=5.231.242.53"},{"time":"2026-10-21 21:38:14","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:14","kind":"客户端指纹","srcIp":"5.231.242.53","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=5.231.242.53"},{"time":"2026-10-21 21:38:14","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 5.231.242.53"},{"time":"2026-10-21 21:38:12","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:12","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:10","kind":"登录成功","srcIp":"163.5.210.194","detail":"蜜罐: 攻击者\"登录成功\" 用户=vigilant 口令=[口令已隐藏] 来源=163.5.210.194"},{"time":"2026-10-21 21:38:08","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:06","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"},{"time":"2026-10-21 21:38:06","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 163.5.210.194"},{"time":"2026-10-21 21:38:06","kind":"客户端指纹","srcIp":"163.5.210.194","detail":"蜜罐: SSH 客户端版本 SSH-2.0-OpenSSH 来源=163.5.210.194"},{"time":"2026-10-21 21:38:06","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 193.32.162.20"},{"time":"2026-10-21 21:38:06","kind":"登录成功","srcIp":"5.231.242.53","detail":"蜜罐: 攻击者\"登录成功\" 用户=user 口令=[口令已隐藏] 来源=5.231.242.53"},{"time":"2026-10-21 21:38:04","kind":"客户端指纹","srcIp":"5.231.242.53","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=5.231.242.53"},{"time":"2026-10-21 21:38:04","kind":"登录成功","srcIp":"193.32.162.20","detail":"蜜罐: 攻击者\"登录成功\" 用户=cchen 口令=[口令已隐藏] 来源=193.32.162.20"},{"time":"2026-10-21 21:38:04","kind":"新连接","srcIp":"未知","detail":"蜜罐: 新的 SSH 连接来自 5.231.242.53"},{"time":"2026-10-21 21:38:02","kind":"客户端指纹","srcIp":"193.32.162.20","detail":"蜜罐: SSH 客户端版本 SSH-2.0-Go 来源=193.32.162.20"}],"ipDisclosure":{"masked":false,"notice":"观测到的来源地址，未经验证，仅供参考","removalContact":"https://xiaokeqing.cn/"}},"audit":{"generatedAt":"2026-10-21 21:38:39","cacheSeconds":45,"readOnly":true,"summary":{"blockTotal":0,"blockActive":0,"blockedByGuard":98,"executedActions":0,"note":"数据来自处置审计留痕文件；IP 显示观测到的真实地址（内网/保留写作「内网/未知」），不含原始 detail"},"blocks":[],"actions":[{"id":"AUD-0379b38e","time":"2026-10-17 15:04:12","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-8b09bf21","time":"2026-10-17 15:00:01","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-1a5ee0d7","time":"2026-10-17 14:59:15","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-db114366","time":"2026-10-17 14:58:54","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-8c39599a","time":"2026-10-17 14:56:46","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-7fc69365","time":"2026-10-17 14:56:36","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-dc9edd4d","time":"2026-10-17 14:56:26","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-464fa2d2","time":"2026-10-17 14:53:18","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-aea62cac","time":"2026-10-17 14:49:58","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-df1be95e","time":"2026-10-17 14:48:47","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-1d6eb844","time":"2026-10-17 14:48:37","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-fb0384f0","time":"2026-10-17 14:48:26","actor":"responder-agent","action":"block-ip","target":"203.0.113.9","reason":"目标命中保护白名单: 203.0.113.0/24","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-72a0f2fb","time":"2026-10-17 14:47:52","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-e4d1f196","time":"2026-10-17 14:47:21","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-7d30f806","time":"2026-10-17 14:47:11","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-8c3d86f5","time":"2026-10-17 14:47:01","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-b1e74639","time":"2026-10-17 12:50:10","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-1636aa99","time":"2026-10-17 12:46:53","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-aad68247","time":"2026-10-17 12:46:17","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-54b7f5a7","time":"2026-10-17 12:45:57","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-e4385762","time":"2026-10-17 12:44:12","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-5d3f91ae","time":"2026-10-17 12:44:04","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-689f939b","time":"2026-10-17 12:43:57","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-149fc47d","time":"2026-10-17 12:41:24","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-1b4664a3","time":"2026-10-17 12:38:40","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-a55b8cd3","time":"2026-10-17 12:37:46","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-98263e26","time":"2026-10-17 12:37:38","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-4b66753c","time":"2026-10-17 12:37:30","actor":"responder-agent","action":"block-ip","target":"203.0.113.9","reason":"目标命中保护白名单: 203.0.113.0/24","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-d780b435","time":"2026-10-17 12:36:33","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false},{"id":"AUD-a236cf27","time":"2026-10-17 12:36:15","actor":"responder-agent","action":"block-ip","target":"未知","reason":"封禁目标 IP 为空","riskLevel":"LOW","mode":"BLOCKED","success":false}],"ipDisclosure":{"masked":false,"notice":"观测到的来源地址，未经验证，仅供参考","removalContact":"https://xiaokeqing.cn/"}},"health":{"status":"ok","buildSha":"5d848e419aa31f412f802c22db5ec1b462dea2ec","sourceSha":"unknown","artifactMd5":"b6665b7b838d58c83a27aba1196bfb1a","buildTime":"unknown","selfReported":true,"runtime":{"startedAt":"2026-10-19T20:30:38+08:00","uptimeSeconds":176881},"dataSource":"WAZUH_REAL"},"ipDisclosure":{"masked":false,"notice":"观测到的来源地址，未经验证，仅供参考","removalContact":"https://xiaokeqing.cn/"}},"snapshotAt":"2026-10-21T21:38:40+08:00","cacheAgeSeconds":28,"snapshotTtlSeconds":45,"freshnessNote":"snapshotAt=本响应体内数据的真实生成时刻（页面按它显示同步时间）；cacheAgeSeconds=生成时它已有多旧；真实年龄=cacheAgeSeconds+响应头Age；禁止给本地址加 ?cb= 之类 cache-buster（会绕过边缘缓存）"}