{"ok": true, "generated_at": "2026-08-05T04:05:25.926697+00:00", "boundary": "observe, report and approval-gated response only", "services": {"sentinel_alert": "active", "sentinel_suricata": "active", "tailscale": "active", "brain": "active", "approval_hub": "active"}, "alert_bridge": {"updated_at": "2026-08-04T12:26:23.680098+00:00", "running": true, "watching": "/var/log/suricata/shire-sentinel/eve.json", "last_alert": {"received_at": "2026-08-04T12:26:23.675990+00:00", "source": "suricata", "self_test": false, "severity": 2, "severity_label": "HIGH", "signature_id": 2019102, "signature": "ET DOS Possible SSDP Amplification Scan in Progress", "category": "Attempted Denial of Service", "action": "allowed", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "delivery": "terminal-broadcast", "notification_allowed": true}}, "recent_alerts": [{"id": "sentinel:e80d98a4b0228d4c12f3eab1412065329a7eb42a", "title": "ET DOS Possible SSDP Amplification Scan in Progress", "severity": "HIGH", "category": "Attempted Denial of Service", "timestamp": "2026-08-04T12:26:23.675990+00:00", "source": "alerts.jsonl", "signature_id": "2019102", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:3795ba55b3eb1949b5e6d1170604721725e2abdc", "title": "ET DOS Possible SSDP Amplification Scan in Progress", "severity": "HIGH", "category": "Attempted Denial of Service", "timestamp": "2026-08-03T18:46:27.308026+00:00", "source": "alerts.jsonl", "signature_id": "2019102", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:50a6d6aa03b6075356a856ef6495c1d645f77786", "title": "ET INFO Possible Powershell .ps1 Script Use Over SMB", "severity": "HIGH", "category": "Potentially Bad Traffic", "timestamp": "2026-08-03T12:55:33.937312+00:00", "source": "alerts.jsonl", "signature_id": "2027203", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 445, "protocol": "TCP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:24a621bb9e72dc9b8cab8fcc35dbbe557a4c189c", "title": "ET INFO Possible Powershell .ps1 Script Use Over SMB", "severity": "HIGH", "category": "Potentially Bad Traffic", "timestamp": "2026-08-03T09:08:55.813275+00:00", "source": "alerts.jsonl", "signature_id": "2027203", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 445, "protocol": "TCP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:aa6ba29321dc006d69b1de8e0a37b06b93294dab", "title": "ET DOS Possible SSDP Amplification Scan in Progress", "severity": "HIGH", "category": "Attempted Denial of Service", "timestamp": "2026-08-02T18:58:41.490427+00:00", "source": "alerts.jsonl", "signature_id": "2019102", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:f49fa5c79e58484f5589cb67459a8a764b6f4569", "title": "ET DOS Possible SSDP Amplification Scan in Progress", "severity": "HIGH", "category": "Attempted Denial of Service", "timestamp": "2026-08-02T00:39:59.621940+00:00", "source": "alerts.jsonl", "signature_id": "2019102", "src_ip": "192.168.1.144", "dest_ip": "192.168.1.1", "dest_port": 1900, "protocol": "UDP", "self_test": false, "action": "allowed", "delivery": "terminal-broadcast"}, {"id": "sentinel:0b81a2750170f3c353ad8e1a8e5b3f29472e2b02", "title": "SHiRE Sentinel alert delivery self-test", "severity": "CRITICAL", "category": "Harmless local test", "timestamp": "2026-08-02T00:02:11.883370+00:00", "source": "alerts.jsonl", "signature_id": "9999999", "src_ip": "192.0.2.10", "dest_ip": "192.0.2.20", "dest_port": 443, "protocol": "TCP", "self_test": true, "action": "allowed", "delivery": "desktop-popup"}], "non_loopback_listeners": ["0.0.0.0:22", "100.116.93.90:33389", "100.116.93.90:4173", "100.116.93.90:4174", "100.116.93.90:8770", "100.116.93.90:8781", "100.116.93.90:8782", "100.116.93.90:8783", "100.116.93.90:8787", "100.116.93.90:8788", "100.116.93.90:8789", "100.116.93.90:8790", "100.116.93.90:8795", "[::]:22", "[::ffff:127.0.0.1]:17059", "[::ffff:127.0.0.1]:34309", "[::ffff:127.0.0.1]:41433", "[fd7a:115c:a1e0::283b:5d5b]:63494", "[fd7a:115c:a1e0::283b:5d5b]:8782", "[fd7a:115c:a1e0::283b:5d5b]:8783"], "supported_actions": ["acknowledge", "defer", "mark_false_positive", "request_investigation"], "blocked_actions": ["automatic isolation", "automatic router blocking", "offensive scanning", "credential attacks"]}