snapshot of https://github.com/zulip/zulip.git @ 48c69911c7dd4e03b20552eb3bd77ad8151c1357 (2026-09-15)

zerver/webhooks/thinkst/fixtures/canary_consolidated_port_scan.json

@@ -0,0 +1,32 @@
+{
+  "ReverseDNS": "attacker.local",
+  "CanaryName": "foo-bar",
+  "Description": "Consolidated Network Port Scan",
+  "CanaryPort": "443",
+  "Timestamp": "2020-07-20 16:18:40 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "A portscan has been done on several of your canaries by the host 1.1.1.1.",
+  "IncidentHash": "3f25fec9e18c7673dcc468800b7af0a6",
+  "CanaryLocation": "dining room",
+  "SourceIP": "1.1.1.1",
+  "AdditionalDetails": [
+    [
+      "Incident",
+      "Consolidated Network Port Scan"
+    ],
+    [
+      "Source",
+      "1.1.1.1"
+    ],
+    [
+      "Targets",
+      "1.0.0.1, 1.0.0.2"
+    ],
+    [
+      "Background Context",
+      "You have had 8 incidents from 1.0.0.1 previously."
+    ]
+  ],
+  "CanaryID": "00000000aa8a310e"
+}

zerver/webhooks/thinkst/fixtures/canary_dummy.json

@@ -0,0 +1,27 @@
+{
+  "ReverseDNS": "attacker-ip.local",
+  "CanaryName": "0000000testnode",
+  "Description": "Dummy Incident",
+  "Timestamp": "2020-06-09 13:59:38 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "This is a dummy incident.",
+  "IncidentHash": "aa875f255f94e3ffe40dc85cf1a8b1e0",
+  "CanaryPort": 8080,
+  "SourceIP": "2.2.2.2",
+  "AdditionalDetails": [
+    [
+      "Field1",
+      "VALUE1"
+    ],
+    [
+      "Field2",
+      "VALUE2"
+    ],
+    [
+      "Field3",
+      "VALUE3"
+    ]
+  ],
+  "CanaryID": "0000000testnode"
+}

zerver/webhooks/thinkst/fixtures/canary_file_access.json

@@ -0,0 +1,32 @@
+{
+  "ReverseDNS": "",
+  "CanaryName": "bar-foo",
+  "Description": "Shared File (Re)Opened",
+  "CanaryPort": 445,
+  "Timestamp": "2020-07-20 16:27:20 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "Shared File (Re)Opened has been detected against one of your Canaries (bar-foo) at 1.1.1.1.",
+  "IncidentHash": "a7bb317ba2072415462233cef3bc615a",
+  "CanaryLocation": "dining room",
+  "SourceIP": "1.1.1.1",
+  "AdditionalDetails": [
+    [
+      "User",
+      "guest"
+    ],
+    [
+      "Filename",
+      "secret/bar.doc"
+    ],
+    [
+      "Additional Information",
+      "This file 'secret/bar.doc' was previously opened by the host 'zulip-dev' on 2020-07-20 16:18:56.\n\nIt was also opened 2 times before by the same host, on 2020-06-10 14:33:50, 2020-06-18 19:02:33."
+    ],
+    [
+      "Background Context",
+      "You have had 20 incidents from 1.1.1.1 previously."
+    ]
+  ],
+  "CanaryID": "00000000aa8a310e"
+}

zerver/webhooks/thinkst/fixtures/canary_host_port_scan.json

@@ -0,0 +1,20 @@
+{
+  "ReverseDNS": "attacker.local",
+  "CanaryName": "foo-bar",
+  "Description": "Host Port Scan",
+  "CanaryPort": "1723",
+  "Timestamp": "2020-07-20 16:26:30 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "Host Port Scan has been detected against one of your Canaries (foo-bar) at 1.1.1.1.",
+  "IncidentHash": "9060473d2da98afe494adad648495620",
+  "CanaryLocation": "dining room",
+  "SourceIP": "1.1.1.1",
+  "AdditionalDetails": [
+    [
+      "Partial Ports",
+      "443, 554, 80, 1723, 22"
+    ]
+  ],
+  "CanaryID": "00024808d6c2f7e5"
+}

zerver/webhooks/thinkst/fixtures/canary_http_login.json

@@ -0,0 +1,32 @@
+{
+  "ReverseDNS": "",
+  "CanaryName": "foo-bar",
+  "Description": "HTTP Login Attempt",
+  "CanaryPort": 80,
+  "Timestamp": "2020-07-20 14:55:45 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "HTTP Login Attempt has been detected against one of your Canaries (foo-bar) at 1.1.1.1.",
+  "IncidentHash": "1ef86f5cf4090a5252c6f453c5cd46bd",
+  "CanaryLocation": "dining room",
+  "SourceIP": "1.1.1.1",
+  "AdditionalDetails": [
+    [
+      "Username",
+      "regular"
+    ],
+    [
+      "Password",
+      "*******"
+    ],
+    [
+      "User-Agent",
+      "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.1.1 Safari/605.1.15"
+    ],
+    [
+      "Background Context",
+      "You have had 14 incidents from 1.1.1.1 previously."
+    ]
+  ],
+  "CanaryID": "00000000d9febd04"
+}

zerver/webhooks/thinkst/fixtures/canary_ssh_login.json

@@ -0,0 +1,28 @@
+{
+  "ReverseDNS": "attacker.local",
+  "CanaryName": "foo-bar",
+  "Description": "SSH Login Attempt",
+  "CanaryPort": 22,
+  "Timestamp": "2020-07-20 16:26:22 (UTC)",
+  "CanaryIP": "1.1.1.1",
+  "AlertType": "CanaryIncident",
+  "Intro": "SSH Login Attempt has been detected against one of your Canaries (foo-bar) at 1.1.1.1.",
+  "IncidentHash": "4ef51a936d05e0a6b4846378c8c38d2c",
+  "CanaryLocation": "dining room",
+  "SourceIP": "1.1.1.1",
+  "AdditionalDetails": [
+    [
+      "Username",
+      "foo"
+    ],
+    [
+      "Key",
+      "*******"
+    ],
+    [
+      "Background Context",
+      "You have had 9 incidents from 1.1.1.1 previously."
+    ]
+  ],
+  "CanaryID": "00024808d6c2f7e5"
+}

zerver/webhooks/thinkst/fixtures/canarytoken_msword.json

@@ -0,0 +1,40 @@
+{
+  "Token": "dbwx4d68flwh2u5zku56nogu6",
+  "Intro": "A MS Word .docx Document Canarytoken has been triggered over doc-msword by the source IP 1.1.1.1.",
+  "Description": "MS Word .docx Document",
+  "Triggered": 5,
+  "AdditionalDetails": [
+    [
+      "Accept",
+      "*/*"
+    ],
+    [
+      "Accept-Encoding",
+      "gzip, deflate"
+    ],
+    [
+      "Accept-Language",
+      "en-gb"
+    ],
+    [
+      "Background Context",
+      "You have had 21 incidents from 1.1.1.1 previously."
+    ],
+    [
+      "Connection",
+      "keep-alive"
+    ],
+    [
+      "Dst Port",
+      80
+    ],
+    [
+      "User-Agent",
+      "Mozilla/4.0 (compatible; ms-office; MSOffice 16)"
+    ]
+  ],
+  "Timestamp": "2020-07-20 14:40:15 (UTC)",
+  "Reminder": "test document",
+  "IncidentHash": "db6f9b5528c6c6c385cb3bb63f5949c8",
+  "AlertType": "CanarytokenIncident"
+}

zerver/webhooks/thinkst/fixtures/canarytoken_remote_image.json

@@ -0,0 +1,48 @@
+{
+  "Token": "ew5n8gqtb82m4uegrttarn2zu",
+  "Intro": "A Remote Web Image Canarytoken has been triggered over web-image by the source IP 1.1.1.1.",
+  "Description": "Remote Web Image",
+  "Triggered": 37,
+  "AdditionalDetails": [
+    [
+      "Accept",
+      "image/webp,*/*"
+    ],
+    [
+      "Accept-Encoding",
+      "gzip, deflate"
+    ],
+    [
+      "Accept-Language",
+      "en-US,en;q=0.5"
+    ],
+    [
+      "Background Context",
+      "You have had 12 incidents from 1.1.1.1 previously."
+    ],
+    [
+      "Cache-Control",
+      "max-age=0"
+    ],
+    [
+      "Connection",
+      "keep-alive"
+    ],
+    [
+      "Dnt",
+      "1"
+    ],
+    [
+      "Dst Port",
+      80
+    ],
+    [
+      "User-Agent",
+      "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0"
+    ]
+  ],
+  "Timestamp": "2020-07-20 16:33:12 (UTC)",
+  "Reminder": "test image",
+  "IncidentHash": "533395067f6d655cd19384bc6991cc0f",
+  "AlertType": "CanarytokenIncident"
+}