correlator01.example.com 2000-03-09T15:31:07Z 192.0.2.200 www.example.com 192.0.2.50 5-25,37,42,43,53,69-119,123-514 portscan http://www.vendor.com/portscan multiple ports in short time 123456781 123456782 123456783 123456784 123456785 123456786 987654321 987654322