The remote web server is using Cloudflare, a cloud-based content delivery network (CDN) service that provides internet security services by acting as a reverse proxy for websites.

Simple Service Discovery Protocol (SSDP) is a network protocol used for advertisement and discovery of network services. SSDP is the basis of Universal Plug and Play (UPnP) and is intended for use in residential or small office environments.

The remote host is acting as a Network Address Translation (NAT) or Proxy device.

NetBIOS over TCP/IP (NBT, or sometimes NetBT) is a networking protocol that allows legacy computer applications relying on the NetBIOS API to be used on modern TCP/IP networks. In a response to another NBT client, the remote host has exposed various system details.

The hostname of this system was observed during an SMB connection setup.

Kibana is an open source analytics and visualization platform designed to work with Elasticsearch. It's used to search, view, and interact with data stored in Elasticsearch indices.

Elasticsearch is a distributed, RESTful search and analytics engine capable of solving a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data so you can discover the expected and uncover the unexpected.

Consul is a distributed, highly available, datacenter-aware, service discovery and configuration system. It can be used to present services and nodes in a flexible and powerful interface that allows clients to always have an up-to-date view of the infrastructure they are a part of.

Consul is a distributed, highly available, datacenter-aware, service discovery and configuration system. It can be used to present services and nodes in a flexible interface that allows clients to always have an up-to-date view of the infrastructure they are a part of.

Cobbler is a Linux provisioning server that facilitates and automates the network-based system installation of multiple computer operating systems from a central point using services such as DHCP, TFTP, and DNS. It can be configured for PXE, reinstallations, and virtualized guests using Xen, KVM or VMware.

Grafana is an open source metric analytics and visualization suite most commonly used for visualizing time series data for infrastructure and application analytics. It is also used in other domains including industrial sensors, home automation, weather, and process control.

The remote host has just accepted an SMB connection.

The operating system of this system was observed during an SMB connection setup.

Chocolatey is a package manager for Windows (like apt-get or yum). It was designed to be a decentralized framework for quickly installing applications and tools. It is built on the NuGet infrastructure currently using PowerShell as its focus for delivering packages from the distros to computer.

NuGet is the package manager for the Microsoft development platform including .NET.

NNM has observed the physical address (MAC) within mDNS traffic from the remote host.

NNM has observed hostname information within mDNS traffic from the remote host.

The remote host is running StackStorm. StackStorm is an event driven platform for integration and automation across services and tools. It ties together your existing infrastructure and automates common operations like troubleshooting, remediation, and continuous deployment.

The remote host is running StackStorm. StackStorm is an event driven platform for integration and automation across services and tools. It ties together your existing infrastructure and and automate common operations like troubleshooting, remdiation, and continuous deployment.

TeamCity is a Java-based build management and continuous integration server from JetBrains.

The remote host is running a network-based AXIS device. Such devices are easy to install, do not require a server, and can be remotely administered via a web GUI.

The remote host is running a network-based AXIS camera. Such cameras are easy to install, do not require a server, and can be remotely administered via a web GUI. By default, anonymous users can connect to the camera and control the camera view, grab stillshot images, and more.

Puppet is an open source systems management tool for centralizing and automating configuration management. Puppet has two layers: a configuration language to describe how the hosts and services should look, and an abstraction layer that allows the administrator to implement the configuration on a variety of Unix, Linux, and Windows platforms.

The remote host has been observed receiving print jobs from clients on the network. While receiving the print job, the document or file name was observed.

The remote host has been observed receiving print jobs from clients on the network. While receiving the print job, the requestor's username or logon account name was observed.

The remote host was observed sending a document to a remote printer or print spooler across the network. While sending the print job, the document or file name was observed.

The remote host was observed sending a document to a remote printer or print spooler across the network. While sending the print job, the username or logon account name was observed.

The remote host was observed sending a document to a remote printer or print spooler across the network.

Jenkins is an open source, cross-platform, continuous integration and continuous delivery application that automates the build, test, and deployment processes of the software development process. 

Jenkins is an open source, cross-platform, continuous integration and continuous delivery application that automates the build, test, and deployment processes of the software development process. Jenkins can be extended via its plugin architecture providing additional functionality like integration with version control systems, databases, and build tools.

An IP-based HID device was detected. HID provides a number of physical access security solutions such as door badge access or fingerprint readers. During a periodic query, the remote HID device and model information have been observed.

An HID badge access door controller was detected. During a periodic query, the remote HID device and model information have been observed from the remote door controller.

The remote host is a VMware vCenter Server. VMware vCenter is a centralized management application that lets you manage virtual machines and ESXi hosts through the vSphere client or a web browser.

The remote host was observed attempting to connect to a remote vCenter server using the VMware vSphere client. While connecting, the target address was observed.

ID	Name	Severity
7255	Cloudflare Client Detection via DNS	info
7252	Cloudflare Client Detection via HTTP/HTTPS	info
9896	SSDP Server Detection	info
9895	SSDP Client Detection	info
7251	NAT/Proxy Detection	info
9803	NetBIOS Response Detection	info
7238	Hostname Detection via SMB	info
9780	Kibana Version Detection	info
9779	Kibana Detection	info
9778	Elasticsearch Detection	info
9770	Consul Detection via HTTP	info
9769	Consul Detection via DNS	info
9768	Cobbler Network Install Detection	info
9767	Cobbler Default PXE Server Detection	info
9766	Grafana Version Detection	info
9765	Grafana Detection	info
9759	SMB Server Detection	info
7239	Operating System Detection via SMB	info
9746	Chocolatey Software Install Detection via NuGet	info
9745	NuGet Version Detection	info
9744	NuGet Detection	info
9743	Chocolatey Software Install Detection	info
9742	Chocolatey Detection	info
7235	MAC Address Detection via mDNS	info
7234	Hostname Detection via mDNS	info
9707	StackStorm Detection	info
7236	StackStorm Hostname Detection	info
9696	TeamCity Version Detection	info
9695	TeamCity Detection	info
9684	AXIS Miscellaneous Device Detection via SNMP	info
9683	AXIS Camera Detection via SNMP	info
9682	AXIS Device Detection via SNMP	info
9681	AXIS Camera Detection via FTP	info
9680	AXIS Device Detection via FTP	info
9672	Puppet Client Detection	info
9671	Puppet Server Detection	info
7233	Puppet Server Hostname Detection	info
9665	Print Job Accepted - Filename Detection	info
9664	Print Job Accepted - Requestor Detection	info
9662	Print Job Requested - Filename Detection	info
9661	Print Job Requested - Username Detection	info
9660	Print Job Request Detection	info
9659	Jenkins Detection	info
9658	Jenkins Plugin Download Detection	info
9657	Jenkins Version Detection	info
9629	HID Device Detection	info
7232	HID Physical Access Device Detection	info
9597	VMware vCenter Server Detection via TLS	info
9596	VMware vCenter Server Detection	info
9593	VMware vSphere Client Connection Detection	info

Detections

Analytics

Generic Family for Nessus Network Monitor

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info

info