diff --git a/filebeat/_meta/fields.common.yml b/filebeat/_meta/fields.common.yml index 44549c80e96..08b7d453eb3 100644 --- a/filebeat/_meta/fields.common.yml +++ b/filebeat/_meta/fields.common.yml @@ -150,11 +150,34 @@ @timestamp is the processed timestamp from the log line. If both are identical only @timestamp should be used. + - name: event.duration + type: long + format: duration + input_format: nanoseconds + description: > + Duration of the event in nanoseconds. + + If event.start and event.end are known this value should be the + difference between the end and start time. + + - name: event.end + type: date + description: > + event.end contains the date when the event ended or when the activity + was last observed. + - name: event.type type: keyword description: > A type given to this kind of event which can be used for grouping. + - name: event.start + level: extended + type: date + description: > + event.start contains the date when the event started or when the + activity was first observed. + - name: http.response.status_code type: long description: > @@ -166,6 +189,12 @@ description: > Elapsed time between request and response in milli seconds. + - name: http.response.body.bytes + type: long + format: bytes + description: > + Size in bytes of the response body. + - name: http.response.content_length type: long description: > @@ -179,6 +208,12 @@ - name: source_ecs type: group fields: + - name: bytes + type: long + format: bytes + description: > + Bytes sent from the source to the destination. + - name: ip type: ip description: > @@ -192,6 +227,12 @@ description: > MAC address of the source. + - name: packets + level: core + type: long + description: > + Packets sent from the client to the server. + - name: port type: long description: > @@ -235,6 +276,19 @@ - name: destination type: group fields: + - name: bytes + level: core + type: long + format: bytes + description: > + Bytes sent from the destination to the source. + + - name: domain + level: core + type: keyword + description: > + Destination domain. + - name: ip type: ip description: > @@ -248,6 +302,12 @@ description: > MAC address of the destination. + - name: packets + level: core + type: long + description: > + Packets sent from the destination to the source. + - name: port type: long description: > @@ -376,6 +436,16 @@ type: group fields: + + - name: domain + level: extended + type: keyword + description: > + Domain of the request, such as "www.elastic.co". + + In some cases a URL may refer to an IP and/or port directly, without a + domain name. In this case, the IP address would go to the `domain` field. + - name: hostname type: keyword description: > @@ -383,6 +453,12 @@ In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `hostname` field. + - name: path + level: extended + type: keyword + description: > + Path of the request, such as "/search". + - name: file description: > File fields provide details about each file. @@ -406,6 +482,29 @@ details about the network activity associated with an event. type: group fields: + - name: bytes + level: core + type: long + format: bytes + description: > + Total bytes transferred in both directions. + If `source.bytes` and `destination.bytes` are known, `network.bytes` is their sum. + + - name: packets + level: core + type: long + description: > + Total packets transferred in both directions. + If `source.packets` and `destination.packets` are known, `network.packets` is their sum. + + - name: protocol + level: core + type: keyword + description: > + L7 Network protocol name. ex. http, lumberjack, transport protocol. + + The field value must be normalized to lowercase for querying. See + "Lowercase Capitalization" in the "Implementing ECS" section. - name: transport level: core diff --git a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json index b42e44ce67c..479990a24c1 100644 --- a/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json +++ b/x-pack/filebeat/module/suricata/eve/ingest/pipeline.json @@ -33,27 +33,58 @@ ,"ignore_missing": true } } + , {"lowercase": + {"field": "suricata.eve.http.http_method" + ,"target_field": "http.request.method" + ,"ignore_missing": true + } + } , {"convert": - {"field": "suricata.eve.http.http_method" - ,"target_field": "http.request.method" + {"field": "suricata.eve.http.status" + ,"target_field": "http.response.status_code" ,"type": "string" ,"ignore_missing": true } } , {"convert": - {"field": "suricata.eve.http.status" - ,"target_field": "http.response.status_code" + {"field": "suricata.eve.http.hostname" + ,"target_field": "url.domain" ,"type": "string" ,"ignore_missing": true } } + , { "grok": + { "field": "suricata.eve.http.url" + , "patterns": ["%{PATH:url.path}(?:\\?%{QUERY:url.query})?(?:#%{ANY:url.fragment})?"] + , "ignore_missing": true + , "pattern_definitions": + { "PATH": "[^?#]*" + , "QUERY": "[^#]*" + , "ANY": ".*" + } + } + } , {"convert": {"field": "suricata.eve.http.hostname" - ,"target_field": "url.hostname" + ,"target_field": "destination.domain" ,"type": "string" ,"ignore_missing": true } } + , {"convert": + {"field": "suricata.eve.http.http_refer" + ,"target_field": "http.request.referrer" + ,"type": "string" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.http.length" + ,"target_field": "http.response.body.bytes" + ,"type": "integer" + ,"ignore_missing": true + } + } , {"convert": {"field": "suricata.eve.fileinfo.filename" ,"target_field": "file.path" @@ -85,15 +116,93 @@ , { "lowercase": { "field": "suricata.eve.event_type" + , "target_field": "event.type" , "ignore_missing": true } } - , { "set": - { "field": "event.type" - , "value": "{{suricata.eve.event_type}}" + , {"convert": + {"field": "suricata.eve.alert.category" + ,"target_field": "message" + ,"type": "string" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.alert.action" + ,"target_field": "event.outcome" + ,"type": "string" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.alert.severity" + ,"target_field": "event.severity" + ,"type": "integer" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.flow.pkts_toclient" + ,"target_field": "destination.packets" + ,"type": "integer" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.flow.pkts_toserver" + ,"target_field": "source_ecs.packets" + ,"type": "integer" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.flow.bytes_toclient" + ,"target_field": "destination.bytes" + ,"type": "integer" + ,"ignore_missing": true + } + } + , {"convert": + {"field": "suricata.eve.flow.bytes_toserver" + ,"target_field": "source_ecs.bytes" + ,"type": "integer" + ,"ignore_missing": true + } + } + , { "script": + { "lang": "painless" + , "source": "long getOrZero(def map, def key) { if(map!=null && map[key]!=null) { return map[key]; } return 0; } def network=ctx['network'], source=ctx['source_ecs'], dest=ctx['destination']; def sp=getOrZero(source,'packets'), sb=getOrZero(source,'bytes'), dp=getOrZero(dest,'packets'), db=getOrZero(dest,'bytes'); if(sb+db+sp+dp > 0){if (network==null){network=new HashMap(); ctx['network']=network; } if(sb+db>0) network['bytes'] = sb+db; if(sp+dp>0) network['packets'] = sp+dp; }" + } + } + , {"date": + {"field": "suricata.eve.flow.start" + ,"target_field": "event.start" + ,"formats": ["ISO8601"] + ,"ignore_failure": true + } + } + , {"set": + {"field": "event.end" + ,"value": "{{@timestamp}}" + } + } + , { "script": + { "lang": "painless" + , "source": "Instant ins(def d){try{return Instant.parse(d);}catch(Exception e){return null;}}def ev=ctx['event'];if(ev!=null){def start=ins(ev['start']); def end=ins(ev['end']); if(start!=null && end!=null && !start.isAfter(end)) {ev['duration'] = Duration.between(start,end).toNanos();}}" + } + } + , { "lowercase": + { "field": "suricata.eve.proto" + , "target_field": "network.transport" + , "ignore_missing": true + } + } + , { "lowercase": + { "field": "suricata.eve.app_proto" + , "target_field": "network.protocol" + , "ignore_missing": true } } - , { "user_agent": { "field": "user_agent.original" , "target_field": "user_agent" diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json index 8acaec245b6..b1caf9ed453 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-alerts.log-expected.json @@ -1,1270 +1,1610 @@ [ { - "@timestamp": "2018-10-03T14:42:44.836Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 0, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32858, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T14:42:44.613469+0000", - "suricata.eve.flow_id": 2191386088856669, - "suricata.eve.http.hostname": "example.net", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1121, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32858, - "suricata.eve.timestamp": "2018-10-03T14:42:44.836744+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T14:42:44.836Z", + "destination.bytes": 1654, + "destination.domain": "example.net", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 223000000, + "event.end": "2018-10-03T14:42:44.836Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T14:42:44.613Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1121, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 0, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32858, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T14:42:44.613469+0000", + "suricata.eve.flow_id": 2191386088856669, + "suricata.eve.http.hostname": "example.net", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1121, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32858, + "suricata.eve.timestamp": "2018-10-03T14:42:44.836744+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.net", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.net", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-03T16:16:26.711Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 723, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32864, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T16:16:26.467217+0000", - "suricata.eve.flow_id": 678269478904081, - "suricata.eve.http.hostname": "example.net", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1121, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32864, - "suricata.eve.timestamp": "2018-10-03T16:16:26.711841+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T16:16:26.711Z", + "destination.bytes": 1654, + "destination.domain": "example.net", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 244000000, + "event.end": "2018-10-03T16:16:26.711Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T16:16:26.467Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1121, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 723, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32864, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T16:16:26.467217+0000", + "suricata.eve.flow_id": 678269478904081, + "suricata.eve.http.hostname": "example.net", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1121, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32864, + "suricata.eve.timestamp": "2018-10-03T16:16:26.711841+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.net", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.net", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-03T16:44:50.813Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 1445, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32870, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T16:44:50.580866+0000", - "suricata.eve.flow_id": 1170030461115650, - "suricata.eve.http.hostname": "example.net", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1126, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32870, - "suricata.eve.timestamp": "2018-10-03T16:44:50.813100+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T16:44:50.813Z", + "destination.bytes": 1654, + "destination.domain": "example.net", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 233000000, + "event.end": "2018-10-03T16:44:50.813Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T16:44:50.580Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1126, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 1445, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32870, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T16:44:50.580866+0000", + "suricata.eve.flow_id": 1170030461115650, + "suricata.eve.http.hostname": "example.net", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1126, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32870, + "suricata.eve.timestamp": "2018-10-03T16:44:50.813100+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.net", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.net", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-03T16:45:09.267Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 2168, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32872, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T16:45:09.036620+0000", - "suricata.eve.flow_id": 49628113637132, - "suricata.eve.http.hostname": "example.org", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1121, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32872, - "suricata.eve.timestamp": "2018-10-03T16:45:09.267308+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T16:45:09.267Z", + "destination.bytes": 1654, + "destination.domain": "example.org", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 231000000, + "event.end": "2018-10-03T16:45:09.267Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T16:45:09.036Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1121, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 2168, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32872, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T16:45:09.036620+0000", + "suricata.eve.flow_id": 49628113637132, + "suricata.eve.http.hostname": "example.org", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1121, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32872, + "suricata.eve.timestamp": "2018-10-03T16:45:09.267308+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.org", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.org", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-03T16:45:34.481Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 2889, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32876, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T16:45:34.252519+0000", - "suricata.eve.flow_id": 116307482565223, - "suricata.eve.http.hostname": "example.org", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1121, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32876, - "suricata.eve.timestamp": "2018-10-03T16:45:34.481113+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T16:45:34.481Z", + "destination.bytes": 1654, + "destination.domain": "example.org", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 229000000, + "event.end": "2018-10-03T16:45:34.481Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T16:45:34.252Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1121, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 2889, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32876, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T16:45:34.252519+0000", + "suricata.eve.flow_id": 116307482565223, + "suricata.eve.http.hostname": "example.org", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1121, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32876, + "suricata.eve.timestamp": "2018-10-03T16:45:34.481113+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.org", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.org", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-03T17:02:38.900Z", - "destination.geo.city_name": "Norwell", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.1508, - "destination.geo.location.lon": -70.8228, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "93.184.216.34", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 3611, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 32892, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Attempted Information Leak", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 4, - "suricata.eve.alert.severity": 2, - "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", - "suricata.eve.alert.signature_id": 2013028, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "93.184.216.34", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 347, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-03T17:02:38.599426+0000", - "suricata.eve.flow_id": 1205867738178946, - "suricata.eve.http.hostname": "example.org", - "suricata.eve.http.http_content_type": "text/html", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "curl/7.58.0", - "suricata.eve.http.length": 1126, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 32892, - "suricata.eve.timestamp": "2018-10-03T17:02:38.900976+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-03T17:02:38.900Z", + "destination.bytes": 1654, + "destination.domain": "example.org", + "destination.geo.city_name": "Norwell", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.1508, + "destination.geo.location.lon": -70.8228, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "93.184.216.34", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 301000000, + "event.end": "2018-10-03T17:02:38.900Z", + "event.outcome": "allowed", + "event.severity": 2, + "event.start": "2018-10-03T17:02:38.599Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1126, + "http.response.status_code": "200", + "input.type": "log", + "message": "Attempted Information Leak", + "network.bytes": 2001, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 3611, + "prospector.type": "log", + "source_ecs.bytes": 347, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 32892, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Attempted Information Leak", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 4, + "suricata.eve.alert.severity": 2, + "suricata.eve.alert.signature": "ET POLICY curl User-Agent Outbound", + "suricata.eve.alert.signature_id": 2013028, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "93.184.216.34", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 347, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-03T17:02:38.599426+0000", + "suricata.eve.flow_id": 1205867738178946, + "suricata.eve.http.hostname": "example.org", + "suricata.eve.http.http_content_type": "text/html", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "curl/7.58.0", + "suricata.eve.http.length": 1126, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 32892, + "suricata.eve.timestamp": "2018-10-03T17:02:38.900976+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "example.org", - "user_agent.device": "Other", - "user_agent.major": "7", - "user_agent.minor": "58", - "user_agent.name": "curl", - "user_agent.os.full_name": "Other", - "user_agent.os.name": "Other", + ], + "url.domain": "example.org", + "url.path": "/", + "user_agent.device": "Other", + "user_agent.major": "7", + "user_agent.minor": "58", + "user_agent.name": "curl", + "user_agent.os.full_name": "Other", + "user_agent.os.name": "Other", "user_agent.patch": "0" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.009Z", - "destination.geo.city_name": "London", - "destination.geo.continent_name": "Europe", - "destination.geo.country_iso_code": "GB", - "destination.geo.location.lat": 51.5142, - "destination.geo.location.lon": -0.0931, - "destination.geo.region_iso_code": "GB-ENG", - "destination.geo.region_name": "England", - "destination.ip": "91.189.88.152", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 4334, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 37742, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.88.152", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1654, - "suricata.eve.flow.bytes_toserver": 497, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", - "suricata.eve.flow_id": 764842923400056, - "suricata.eve.http.hostname": "security.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 1138, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-security/InRelease", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 37742, - "suricata.eve.timestamp": "2018-10-04T09:34:59.009897+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-04T09:34:59.009Z", + "destination.bytes": 1654, + "destination.domain": "security.ubuntu.com", + "destination.geo.city_name": "London", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "GB", + "destination.geo.location.lat": 51.5142, + "destination.geo.location.lon": -0.0931, + "destination.geo.region_iso_code": "GB-ENG", + "destination.geo.region_name": "England", + "destination.ip": "91.189.88.152", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 85000000, + "event.end": "2018-10-04T09:34:59.009Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.924Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1138, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 2151, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 4334, + "prospector.type": "log", + "source_ecs.bytes": 497, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 37742, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.88.152", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1654, + "suricata.eve.flow.bytes_toserver": 497, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", + "suricata.eve.flow_id": 764842923400056, + "suricata.eve.http.hostname": "security.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 1138, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-security/InRelease", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 37742, + "suricata.eve.timestamp": "2018-10-04T09:34:59.009897+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "security.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "security.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-security/InRelease", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.168Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "304", - "input.type": "log", - "offset": 5140, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 417, - "suricata.eve.flow.bytes_toserver": 487, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 0, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 304, - "suricata.eve.http.url": "/ubuntu/dists/bionic/InRelease", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:34:59.168340+0000", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-10-04T09:34:59.168Z", + "destination.bytes": 417, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 3, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 242000000, + "event.end": "2018-10-04T09:34:59.168Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 0, + "http.response.status_code": "304", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 904, + "network.packets": 7, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 5140, + "prospector.type": "log", + "source_ecs.bytes": 487, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 4, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 417, + "suricata.eve.flow.bytes_toserver": 487, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 0, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 304, + "suricata.eve.http.url": "/ubuntu/dists/bionic/InRelease", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:34:59.168340+0000", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic/InRelease", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.288Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 5931, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 3445, - "suricata.eve.flow.bytes_toserver": 842, - "suricata.eve.flow.pkts_toclient": 5, - "suricata.eve.flow.pkts_toserver": 6, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2601, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/InRelease", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:34:59.288862+0000", - "suricata.eve.tx_id": 1, + "@timestamp": "2018-10-04T09:34:59.288Z", + "destination.bytes": 3445, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 5, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 362000000, + "event.end": "2018-10-04T09:34:59.288Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2601, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 4287, + "network.packets": 11, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 5931, + "prospector.type": "log", + "source_ecs.bytes": 842, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 6, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 3445, + "suricata.eve.flow.bytes_toserver": 842, + "suricata.eve.flow.pkts_toclient": 5, + "suricata.eve.flow.pkts_toserver": 6, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2601, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/InRelease", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:34:59.288862+0000", + "suricata.eve.tx_id": 1, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/InRelease", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.289Z", - "destination.geo.city_name": "London", - "destination.geo.continent_name": "Europe", - "destination.geo.country_iso_code": "GB", - "destination.geo.location.lat": 51.5142, - "destination.geo.location.lon": -0.0931, - "destination.geo.region_iso_code": "GB-ENG", - "destination.geo.region_name": "England", - "destination.ip": "91.189.88.152", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 6734, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 37742, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.88.152", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 90543, - "suricata.eve.flow.bytes_toserver": 4810, - "suricata.eve.flow.pkts_toclient": 62, - "suricata.eve.flow.pkts_toserver": 64, - "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", - "suricata.eve.flow_id": 764842923400056, - "suricata.eve.http.hostname": "security.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 1241, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-security/main/source/by-hash/SHA256/f5ec03d97ca76c98162d9233c8b7c578c52897e2136428277baf2e7b633a8e72", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 37742, - "suricata.eve.timestamp": "2018-10-04T09:34:59.289324+0000", - "suricata.eve.tx_id": 1, + "@timestamp": "2018-10-04T09:34:59.289Z", + "destination.bytes": 90543, + "destination.domain": "security.ubuntu.com", + "destination.geo.city_name": "London", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "GB", + "destination.geo.location.lat": 51.5142, + "destination.geo.location.lon": -0.0931, + "destination.geo.region_iso_code": "GB-ENG", + "destination.geo.region_name": "England", + "destination.ip": "91.189.88.152", + "destination.packets": 62, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 365000000, + "event.end": "2018-10-04T09:34:59.289Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.924Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1241, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 95353, + "network.packets": 126, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 6734, + "prospector.type": "log", + "source_ecs.bytes": 4810, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 64, + "source_ecs.port": 37742, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.88.152", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 90543, + "suricata.eve.flow.bytes_toserver": 4810, + "suricata.eve.flow.pkts_toclient": 62, + "suricata.eve.flow.pkts_toserver": 64, + "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", + "suricata.eve.flow_id": 764842923400056, + "suricata.eve.http.hostname": "security.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 1241, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-security/main/source/by-hash/SHA256/f5ec03d97ca76c98162d9233c8b7c578c52897e2136428277baf2e7b633a8e72", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 37742, + "suricata.eve.timestamp": "2018-10-04T09:34:59.289324+0000", + "suricata.eve.tx_id": 1, "tags": [ "suricata" - ], - "url.hostname": "security.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "security.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-security/main/source/by-hash/SHA256/f5ec03d97ca76c98162d9233c8b7c578c52897e2136428277baf2e7b633a8e72", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.356Z", - "destination.geo.city_name": "London", - "destination.geo.continent_name": "Europe", - "destination.geo.country_iso_code": "GB", - "destination.geo.location.lat": 51.5142, - "destination.geo.location.lon": -0.0931, - "destination.geo.region_iso_code": "GB-ENG", - "destination.geo.region_name": "England", - "destination.ip": "91.189.88.152", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 7630, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 37742, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.88.152", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 145014, - "suricata.eve.flow.bytes_toserver": 6591, - "suricata.eve.flow.pkts_toclient": 98, - "suricata.eve.flow.pkts_toserver": 87, - "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", - "suricata.eve.flow_id": 764842923400056, - "suricata.eve.http.hostname": "security.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2687, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-security/main/binary-amd64/by-hash/SHA256/c5b8346a3221bc9a23a79ba4dc4e730a6319a77fc9d63872dfc56539a0810015", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 37742, - "suricata.eve.timestamp": "2018-10-04T09:34:59.356132+0000", - "suricata.eve.tx_id": 2, + "@timestamp": "2018-10-04T09:34:59.356Z", + "destination.bytes": 145014, + "destination.domain": "security.ubuntu.com", + "destination.geo.city_name": "London", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "GB", + "destination.geo.location.lat": 51.5142, + "destination.geo.location.lon": -0.0931, + "destination.geo.region_iso_code": "GB-ENG", + "destination.geo.region_name": "England", + "destination.ip": "91.189.88.152", + "destination.packets": 98, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 432000000, + "event.end": "2018-10-04T09:34:59.356Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.924Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2687, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 151605, + "network.packets": 185, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 7630, + "prospector.type": "log", + "source_ecs.bytes": 6591, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 87, + "source_ecs.port": 37742, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.88.152", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 145014, + "suricata.eve.flow.bytes_toserver": 6591, + "suricata.eve.flow.pkts_toclient": 98, + "suricata.eve.flow.pkts_toserver": 87, + "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", + "suricata.eve.flow_id": 764842923400056, + "suricata.eve.http.hostname": "security.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2687, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-security/main/binary-amd64/by-hash/SHA256/c5b8346a3221bc9a23a79ba4dc4e730a6319a77fc9d63872dfc56539a0810015", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 37742, + "suricata.eve.timestamp": "2018-10-04T09:34:59.356132+0000", + "suricata.eve.tx_id": 2, "tags": [ "suricata" - ], - "url.hostname": "security.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "security.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-security/main/binary-amd64/by-hash/SHA256/c5b8346a3221bc9a23a79ba4dc4e730a6319a77fc9d63872dfc56539a0810015", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.456Z", - "destination.geo.city_name": "London", - "destination.geo.continent_name": "Europe", - "destination.geo.country_iso_code": "GB", - "destination.geo.location.lat": 51.5142, - "destination.geo.location.lon": -0.0931, - "destination.geo.region_iso_code": "GB-ENG", - "destination.geo.region_name": "England", - "destination.ip": "91.189.88.152", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 8533, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 37742, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.88.152", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 330525, - "suricata.eve.flow.bytes_toserver": 11460, - "suricata.eve.flow.pkts_toclient": 221, - "suricata.eve.flow.pkts_toserver": 156, - "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", - "suricata.eve.flow_id": 764842923400056, - "suricata.eve.http.hostname": "security.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2688, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-security/universe/binary-amd64/by-hash/SHA256/e5cc957139a25a0fee47cbf2c0fac8ad5cab50346d6a74abe031748924c5b558", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 37742, - "suricata.eve.timestamp": "2018-10-04T09:34:59.456919+0000", - "suricata.eve.tx_id": 3, + "@timestamp": "2018-10-04T09:34:59.456Z", + "destination.bytes": 330525, + "destination.domain": "security.ubuntu.com", + "destination.geo.city_name": "London", + "destination.geo.continent_name": "Europe", + "destination.geo.country_iso_code": "GB", + "destination.geo.location.lat": 51.5142, + "destination.geo.location.lon": -0.0931, + "destination.geo.region_iso_code": "GB-ENG", + "destination.geo.region_name": "England", + "destination.ip": "91.189.88.152", + "destination.packets": 221, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 532000000, + "event.end": "2018-10-04T09:34:59.456Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.924Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2688, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 341985, + "network.packets": 377, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 8533, + "prospector.type": "log", + "source_ecs.bytes": 11460, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 156, + "source_ecs.port": 37742, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.88.152", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 330525, + "suricata.eve.flow.bytes_toserver": 11460, + "suricata.eve.flow.pkts_toclient": 221, + "suricata.eve.flow.pkts_toserver": 156, + "suricata.eve.flow.start": "2018-10-04T09:34:58.924536+0000", + "suricata.eve.flow_id": 764842923400056, + "suricata.eve.http.hostname": "security.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2688, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-security/universe/binary-amd64/by-hash/SHA256/e5cc957139a25a0fee47cbf2c0fac8ad5cab50346d6a74abe031748924c5b558", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 37742, + "suricata.eve.timestamp": "2018-10-04T09:34:59.456919+0000", + "suricata.eve.tx_id": 3, "tags": [ "suricata" - ], - "url.hostname": "security.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "security.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-security/universe/binary-amd64/by-hash/SHA256/e5cc957139a25a0fee47cbf2c0fac8ad5cab50346d6a74abe031748924c5b558", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.747Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 9443, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 96554, - "suricata.eve.flow.bytes_toserver": 4895, - "suricata.eve.flow.pkts_toclient": 67, - "suricata.eve.flow.pkts_toserver": 64, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2601, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-backports/InRelease", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:34:59.747122+0000", - "suricata.eve.tx_id": 2, + "@timestamp": "2018-10-04T09:34:59.747Z", + "destination.bytes": 96554, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 67, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 821000000, + "event.end": "2018-10-04T09:34:59.747Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2601, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 101449, + "network.packets": 131, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 9443, + "prospector.type": "log", + "source_ecs.bytes": 4895, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 64, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 96554, + "suricata.eve.flow.bytes_toserver": 4895, + "suricata.eve.flow.pkts_toclient": 67, + "suricata.eve.flow.pkts_toserver": 64, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2601, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-backports/InRelease", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:34:59.747122+0000", + "suricata.eve.tx_id": 2, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-backports/InRelease", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:34:59.953Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 10252, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 174843, - "suricata.eve.flow.bytes_toserver": 6932, - "suricata.eve.flow.pkts_toclient": 119, - "suricata.eve.flow.pkts_toserver": 91, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2687, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/main/source/by-hash/SHA256/65f2e3a4e9d89d9d4b5e3d42e586bc96f48a24466b0ad0b4a707255e44a26b03", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:34:59.953886+0000", - "suricata.eve.tx_id": 3, + "@timestamp": "2018-10-04T09:34:59.953Z", + "destination.bytes": 174843, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 119, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 1027000000, + "event.end": "2018-10-04T09:34:59.953Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2687, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 181775, + "network.packets": 210, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 10252, + "prospector.type": "log", + "source_ecs.bytes": 6932, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 91, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 174843, + "suricata.eve.flow.bytes_toserver": 6932, + "suricata.eve.flow.pkts_toclient": 119, + "suricata.eve.flow.pkts_toserver": 91, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2687, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/main/source/by-hash/SHA256/65f2e3a4e9d89d9d4b5e3d42e586bc96f48a24466b0ad0b4a707255e44a26b03", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:34:59.953886+0000", + "suricata.eve.tx_id": 3, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/main/source/by-hash/SHA256/65f2e3a4e9d89d9d4b5e3d42e586bc96f48a24466b0ad0b4a707255e44a26b03", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:00.250Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 11147, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 376452, - "suricata.eve.flow.bytes_toserver": 11679, - "suricata.eve.flow.pkts_toclient": 253, - "suricata.eve.flow.pkts_toserver": 159, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2688, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/source/by-hash/SHA256/56cfd9cc2efa61dff7428dddf921c3cd6047ab8e6484a7f1888e4c3f7252f1ef", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:00.250560+0000", - "suricata.eve.tx_id": 4, + "@timestamp": "2018-10-04T09:35:00.250Z", + "destination.bytes": 376452, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 253, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 1324000000, + "event.end": "2018-10-04T09:35:00.250Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2688, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 388131, + "network.packets": 412, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 11147, + "prospector.type": "log", + "source_ecs.bytes": 11679, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 159, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 376452, + "suricata.eve.flow.bytes_toserver": 11679, + "suricata.eve.flow.pkts_toclient": 253, + "suricata.eve.flow.pkts_toserver": 159, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2688, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/source/by-hash/SHA256/56cfd9cc2efa61dff7428dddf921c3cd6047ab8e6484a7f1888e4c3f7252f1ef", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:00.250560+0000", + "suricata.eve.tx_id": 4, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/universe/source/by-hash/SHA256/56cfd9cc2efa61dff7428dddf921c3cd6047ab8e6484a7f1888e4c3f7252f1ef", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:00.401Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 12048, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 468170, - "suricata.eve.flow.bytes_toserver": 13986, - "suricata.eve.flow.pkts_toclient": 314, - "suricata.eve.flow.pkts_toserver": 190, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2687, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/main/binary-amd64/by-hash/SHA256/4360137dc8f98b47648da1fef5472ef234fb02115bc2b29873bcaeee62637e70", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:00.401788+0000", - "suricata.eve.tx_id": 5, + "@timestamp": "2018-10-04T09:35:00.401Z", + "destination.bytes": 468170, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 314, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 1475000000, + "event.end": "2018-10-04T09:35:00.401Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2687, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 482156, + "network.packets": 504, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 12048, + "prospector.type": "log", + "source_ecs.bytes": 13986, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 190, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 468170, + "suricata.eve.flow.bytes_toserver": 13986, + "suricata.eve.flow.pkts_toclient": 314, + "suricata.eve.flow.pkts_toserver": 190, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2687, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/main/binary-amd64/by-hash/SHA256/4360137dc8f98b47648da1fef5472ef234fb02115bc2b29873bcaeee62637e70", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:00.401788+0000", + "suricata.eve.tx_id": 5, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/main/binary-amd64/by-hash/SHA256/4360137dc8f98b47648da1fef5472ef234fb02115bc2b29873bcaeee62637e70", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:00.776Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 12951, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 880323, - "suricata.eve.flow.bytes_toserver": 23361, - "suricata.eve.flow.pkts_toclient": 588, - "suricata.eve.flow.pkts_toserver": 328, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2691, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/restricted/binary-amd64/by-hash/SHA256/c93fdc7f10cad1263349fd7b5bdd6a7f7163165b96ad263b3e12022e319d0d12", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:00.776438+0000", - "suricata.eve.tx_id": 6, + "@timestamp": "2018-10-04T09:35:00.776Z", + "destination.bytes": 880323, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 588, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 1850000000, + "event.end": "2018-10-04T09:35:00.776Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2691, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 903684, + "network.packets": 916, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 12951, + "prospector.type": "log", + "source_ecs.bytes": 23361, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 328, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 880323, + "suricata.eve.flow.bytes_toserver": 23361, + "suricata.eve.flow.pkts_toclient": 588, + "suricata.eve.flow.pkts_toserver": 328, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2691, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/restricted/binary-amd64/by-hash/SHA256/c93fdc7f10cad1263349fd7b5bdd6a7f7163165b96ad263b3e12022e319d0d12", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:00.776438+0000", + "suricata.eve.tx_id": 6, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/restricted/binary-amd64/by-hash/SHA256/c93fdc7f10cad1263349fd7b5bdd6a7f7163165b96ad263b3e12022e319d0d12", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:00.897Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 13860, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 884342, - "suricata.eve.flow.bytes_toserver": 23758, - "suricata.eve.flow.pkts_toclient": 591, - "suricata.eve.flow.pkts_toserver": 330, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 2687, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/binary-amd64/by-hash/SHA256/5190f7afbee38b3cb32225db478fdbabd46f76eaa9c5921a13091891bf3e9bbc", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:00.897009+0000", - "suricata.eve.tx_id": 7, + "@timestamp": "2018-10-04T09:35:00.897Z", + "destination.bytes": 884342, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 591, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 1971000000, + "event.end": "2018-10-04T09:35:00.897Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 2687, + "http.response.status_code": "200", + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 908100, + "network.packets": 921, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 13860, + "prospector.type": "log", + "source_ecs.bytes": 23758, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 330, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 884342, + "suricata.eve.flow.bytes_toserver": 23758, + "suricata.eve.flow.pkts_toclient": 591, + "suricata.eve.flow.pkts_toserver": 330, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 2687, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/binary-amd64/by-hash/SHA256/5190f7afbee38b3cb32225db478fdbabd46f76eaa9c5921a13091891bf3e9bbc", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:00.897009+0000", + "suricata.eve.tx_id": 7, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/universe/binary-amd64/by-hash/SHA256/5190f7afbee38b3cb32225db478fdbabd46f76eaa9c5921a13091891bf3e9bbc", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:01.362Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "input.type": "log", - "offset": 14767, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1467603, - "suricata.eve.flow.bytes_toserver": 36819, - "suricata.eve.flow.pkts_toclient": 979, - "suricata.eve.flow.pkts_toserver": 524, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 0, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/i18n/by-hash/SHA256/9fe539b7036e51327cd85ca5e0a4dd4eb47f69168875de2ac9842a5e36ebd4a4", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:01.362208+0000", - "suricata.eve.tx_id": 8, + "@timestamp": "2018-10-04T09:35:01.362Z", + "destination.bytes": 1467603, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 979, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 2436000000, + "event.end": "2018-10-04T09:35:01.362Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 0, + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 1504422, + "network.packets": 1503, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 14767, + "prospector.type": "log", + "source_ecs.bytes": 36819, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 524, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1467603, + "suricata.eve.flow.bytes_toserver": 36819, + "suricata.eve.flow.pkts_toclient": 979, + "suricata.eve.flow.pkts_toserver": 524, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 0, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/universe/i18n/by-hash/SHA256/9fe539b7036e51327cd85ca5e0a4dd4eb47f69168875de2ac9842a5e36ebd4a4", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:01.362208+0000", + "suricata.eve.tx_id": 8, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/universe/i18n/by-hash/SHA256/9fe539b7036e51327cd85ca5e0a4dd4eb47f69168875de2ac9842a5e36ebd4a4", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" - }, + }, { - "@timestamp": "2018-10-04T09:35:01.575Z", - "destination.geo.city_name": "Boston", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 42.3584, - "destination.geo.location.lon": -71.0598, - "destination.geo.region_iso_code": "US-MA", - "destination.geo.region_name": "Massachusetts", - "destination.ip": "91.189.91.23", - "destination.port": 80, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "input.type": "log", - "offset": 15651, - "prospector.type": "log", - "source_ecs.ip": "192.168.1.146", - "source_ecs.port": 52340, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Not Suspicious Traffic", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 5, - "suricata.eve.alert.severity": 3, - "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", - "suricata.eve.alert.signature_id": 2013504, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "91.189.91.23", - "suricata.eve.dest_port": 80, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 1618380, - "suricata.eve.flow.bytes_toserver": 40452, - "suricata.eve.flow.pkts_toclient": 1079, - "suricata.eve.flow.pkts_toserver": 575, - "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", - "suricata.eve.flow_id": 112424506237238, - "suricata.eve.http.hostname": "archive.ubuntu.com", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", - "suricata.eve.http.length": 0, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/multiverse/binary-amd64/by-hash/SHA256/8ab8cb220c0e50521c589acc2bc2b43a3121210f0b035a0605972bcffd73dd16", - "suricata.eve.in_iface": "enp0s3", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.1.146", - "suricata.eve.src_port": 52340, - "suricata.eve.timestamp": "2018-10-04T09:35:01.575088+0000", - "suricata.eve.tx_id": 9, + "@timestamp": "2018-10-04T09:35:01.575Z", + "destination.bytes": 1618380, + "destination.domain": "archive.ubuntu.com", + "destination.geo.city_name": "Boston", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 42.3584, + "destination.geo.location.lon": -71.0598, + "destination.geo.region_iso_code": "US-MA", + "destination.geo.region_name": "Massachusetts", + "destination.ip": "91.189.91.23", + "destination.packets": 1079, + "destination.port": 80, + "event.dataset": "suricata.eve", + "event.duration": 2649000000, + "event.end": "2018-10-04T09:35:01.575Z", + "event.outcome": "allowed", + "event.severity": 3, + "event.start": "2018-10-04T09:34:58.926Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 0, + "input.type": "log", + "message": "Not Suspicious Traffic", + "network.bytes": 1658832, + "network.packets": 1654, + "network.protocol": "http", + "network.transport": "tcp", + "offset": 15651, + "prospector.type": "log", + "source_ecs.bytes": 40452, + "source_ecs.ip": "192.168.1.146", + "source_ecs.packets": 575, + "source_ecs.port": 52340, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Not Suspicious Traffic", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 5, + "suricata.eve.alert.severity": 3, + "suricata.eve.alert.signature": "ET POLICY GNU/Linux APT User-Agent Outbound likely related to package management", + "suricata.eve.alert.signature_id": 2013504, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "91.189.91.23", + "suricata.eve.dest_port": 80, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 1618380, + "suricata.eve.flow.bytes_toserver": 40452, + "suricata.eve.flow.pkts_toclient": 1079, + "suricata.eve.flow.pkts_toserver": 575, + "suricata.eve.flow.start": "2018-10-04T09:34:58.926006+0000", + "suricata.eve.flow_id": 112424506237238, + "suricata.eve.http.hostname": "archive.ubuntu.com", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Debian APT-HTTP/1.3 (1.6.3ubuntu0.1)", + "suricata.eve.http.length": 0, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.url": "/ubuntu/dists/bionic-updates/multiverse/binary-amd64/by-hash/SHA256/8ab8cb220c0e50521c589acc2bc2b43a3121210f0b035a0605972bcffd73dd16", + "suricata.eve.in_iface": "enp0s3", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.1.146", + "suricata.eve.src_port": 52340, + "suricata.eve.timestamp": "2018-10-04T09:35:01.575088+0000", + "suricata.eve.tx_id": 9, "tags": [ "suricata" - ], - "url.hostname": "archive.ubuntu.com", - "user_agent.device": "Other", - "user_agent.major": "1", - "user_agent.minor": "3", - "user_agent.name": "Debian APT-HTTP", - "user_agent.os.full_name": "Debian", + ], + "url.domain": "archive.ubuntu.com", + "url.path": "/ubuntu/dists/bionic-updates/multiverse/binary-amd64/by-hash/SHA256/8ab8cb220c0e50521c589acc2bc2b43a3121210f0b035a0605972bcffd73dd16", + "user_agent.device": "Other", + "user_agent.major": "1", + "user_agent.minor": "3", + "user_agent.name": "Debian APT-HTTP", + "user_agent.os.full_name": "Debian", "user_agent.os.name": "Debian" } ] \ No newline at end of file diff --git a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json index ffa2ce7f0f4..682cad51bd8 100644 --- a/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json +++ b/x-pack/filebeat/module/suricata/eve/test/eve-small.log-expected.json @@ -1,416 +1,459 @@ [ { - "@timestamp": "2018-07-05T19:01:09.820Z", - "destination.ip": "192.168.253.112", - "destination.port": 22, - "event.dataset": "suricata.eve", - "event.type": "ssh", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 0, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.85", - "source_ecs.port": 55406, - "suricata.eve.dest_ip": "192.168.253.112", - "suricata.eve.dest_port": 22, - "suricata.eve.event_type": "ssh", - "suricata.eve.flow_id": 298824096901438, - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.86.85", - "suricata.eve.src_port": 55406, - "suricata.eve.ssh.client.proto_version": "2.0", - "suricata.eve.ssh.client.software_version": "OpenSSH_7.6", - "suricata.eve.ssh.server.proto_version": "2.0", - "suricata.eve.ssh.server.software_version": "libssh_0.7.0", - "suricata.eve.timestamp": "2018-07-05T15:01:09.820360-0400", + "@timestamp": "2018-07-05T19:01:09.820Z", + "destination.ip": "192.168.253.112", + "destination.port": 22, + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:01:09.820Z", + "event.type": "ssh", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "network.transport": "tcp", + "offset": 0, + "prospector.type": "log", + "source_ecs.ip": "192.168.86.85", + "source_ecs.port": 55406, + "suricata.eve.dest_ip": "192.168.253.112", + "suricata.eve.dest_port": 22, + "suricata.eve.event_type": "ssh", + "suricata.eve.flow_id": 298824096901438, + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.86.85", + "suricata.eve.src_port": 55406, + "suricata.eve.ssh.client.proto_version": "2.0", + "suricata.eve.ssh.client.software_version": "OpenSSH_7.6", + "suricata.eve.ssh.server.proto_version": "2.0", + "suricata.eve.ssh.server.software_version": "libssh_0.7.0", + "suricata.eve.timestamp": "2018-07-05T15:01:09.820360-0400", "tags": [ "suricata" ] - }, + }, { - "@timestamp": "2018-07-05T19:07:20.910Z", - "destination.ip": "192.168.156.70", - "destination.port": 443, - "event.dataset": "suricata.eve", - "event.type": "alert", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 350, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.85", - "source_ecs.port": 55641, - "suricata.eve.alert.action": "allowed", - "suricata.eve.alert.category": "Potential Corporate Privacy Violation", - "suricata.eve.alert.gid": 1, - "suricata.eve.alert.rev": 3, - "suricata.eve.alert.severity": 1, - "suricata.eve.alert.signature": "ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)", - "suricata.eve.alert.signature_id": 2024833, - "suricata.eve.app_proto": "tls", - "suricata.eve.dest_ip": "192.168.156.70", - "suricata.eve.dest_port": 443, - "suricata.eve.event_type": "alert", - "suricata.eve.flow.bytes_toclient": 343, - "suricata.eve.flow.bytes_toserver": 793, - "suricata.eve.flow.pkts_toclient": 3, - "suricata.eve.flow.pkts_toserver": 4, - "suricata.eve.flow.start": "2018-07-05T15:07:19.659593-0400", - "suricata.eve.flow_id": 904992230150281, - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.86.85", - "suricata.eve.src_port": 55641, - "suricata.eve.timestamp": "2018-07-05T15:07:20.910626-0400", - "suricata.eve.tls.session_resumed": true, - "suricata.eve.tls.sni": "l2.io", - "suricata.eve.tls.version": "TLS 1.2", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-07-05T19:07:20.910Z", + "destination.bytes": 343, + "destination.ip": "192.168.156.70", + "destination.packets": 3, + "destination.port": 443, + "event.dataset": "suricata.eve", + "event.duration": 1251000000, + "event.end": "2018-07-05T19:07:20.910Z", + "event.outcome": "allowed", + "event.severity": 1, + "event.start": "2018-07-05T19:07:19.659Z", + "event.type": "alert", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "message": "Potential Corporate Privacy Violation", + "network.bytes": 1136, + "network.packets": 7, + "network.protocol": "tls", + "network.transport": "tcp", + "offset": 350, + "prospector.type": "log", + "source_ecs.bytes": 793, + "source_ecs.ip": "192.168.86.85", + "source_ecs.packets": 4, + "source_ecs.port": 55641, + "suricata.eve.alert.action": "allowed", + "suricata.eve.alert.category": "Potential Corporate Privacy Violation", + "suricata.eve.alert.gid": 1, + "suricata.eve.alert.rev": 3, + "suricata.eve.alert.severity": 1, + "suricata.eve.alert.signature": "ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)", + "suricata.eve.alert.signature_id": 2024833, + "suricata.eve.app_proto": "tls", + "suricata.eve.dest_ip": "192.168.156.70", + "suricata.eve.dest_port": 443, + "suricata.eve.event_type": "alert", + "suricata.eve.flow.bytes_toclient": 343, + "suricata.eve.flow.bytes_toserver": 793, + "suricata.eve.flow.pkts_toclient": 3, + "suricata.eve.flow.pkts_toserver": 4, + "suricata.eve.flow.start": "2018-07-05T15:07:19.659593-0400", + "suricata.eve.flow_id": 904992230150281, + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.86.85", + "suricata.eve.src_port": 55641, + "suricata.eve.timestamp": "2018-07-05T15:07:20.910626-0400", + "suricata.eve.tls.session_resumed": true, + "suricata.eve.tls.sni": "l2.io", + "suricata.eve.tls.version": "TLS 1.2", + "suricata.eve.tx_id": 0, "tags": [ "suricata" ] - }, + }, { - "@timestamp": "2018-07-05T19:43:47.690Z", - "destination.ip": "192.168.86.28", - "destination.port": 63963, - "event.dataset": "suricata.eve", - "event.type": "http", - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 985, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.85", - "source_ecs.port": 56119, - "suricata.eve.dest_ip": "192.168.86.28", - "suricata.eve.dest_port": 63963, - "suricata.eve.event_type": "http", - "suricata.eve.flow_id": 2115002772430095, - "suricata.eve.http.hostname": "192.168.86.28", - "suricata.eve.http.http_content_type": "text/xml", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", - "suricata.eve.http.length": 1155, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/dd.xml", - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.86.85", - "suricata.eve.src_port": 56119, - "suricata.eve.timestamp": "2018-07-05T15:43:47.690014-0400", - "suricata.eve.tx_id": 0, + "@timestamp": "2018-07-05T19:43:47.690Z", + "destination.domain": "192.168.86.28", + "destination.ip": "192.168.86.28", + "destination.port": 63963, + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:43:47.690Z", + "event.type": "http", + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1155, + "http.response.status_code": "200", + "input.type": "log", + "network.transport": "tcp", + "offset": 985, + "prospector.type": "log", + "source_ecs.ip": "192.168.86.85", + "source_ecs.port": 56119, + "suricata.eve.dest_ip": "192.168.86.28", + "suricata.eve.dest_port": 63963, + "suricata.eve.event_type": "http", + "suricata.eve.flow_id": 2115002772430095, + "suricata.eve.http.hostname": "192.168.86.28", + "suricata.eve.http.http_content_type": "text/xml", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", + "suricata.eve.http.length": 1155, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/dd.xml", + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.86.85", + "suricata.eve.src_port": 56119, + "suricata.eve.timestamp": "2018-07-05T15:43:47.690014-0400", + "suricata.eve.tx_id": 0, "tags": [ "suricata" - ], - "url.hostname": "192.168.86.28", - "user_agent.device": "Other", - "user_agent.major": "67", - "user_agent.minor": "0", - "user_agent.name": "Chrome", - "user_agent.os.full_name": "Mac OS X 10.13.5", - "user_agent.os.major": "10", - "user_agent.os.minor": "13", - "user_agent.os.name": "Mac OS X", + ], + "url.domain": "192.168.86.28", + "url.path": "/dd.xml", + "user_agent.device": "Other", + "user_agent.major": "67", + "user_agent.minor": "0", + "user_agent.name": "Chrome", + "user_agent.os.full_name": "Mac OS X 10.13.5", + "user_agent.os.major": "10", + "user_agent.os.minor": "13", + "user_agent.os.name": "Mac OS X", "user_agent.patch": "3396" - }, + }, { - "@timestamp": "2018-07-05T19:44:33.222Z", - "destination.ip": "192.168.86.85", - "destination.port": 56118, - "event.dataset": "suricata.eve", - "event.type": "fileinfo", - "file.path": "/ssdp/device-desc.xml", - "file.size": 1071, - "fileset.module": "suricata", - "fileset.name": "eve", - "http.request.method": "GET", - "http.response.status_code": "200", - "input.type": "log", - "offset": 1507, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.28", - "source_ecs.port": 8008, - "suricata.eve.app_proto": "http", - "suricata.eve.dest_ip": "192.168.86.85", - "suricata.eve.dest_port": 56118, - "suricata.eve.event_type": "fileinfo", - "suricata.eve.fileinfo.filename": "/ssdp/device-desc.xml", - "suricata.eve.fileinfo.gaps": false, - "suricata.eve.fileinfo.md5": "427b7337ff37eeb24d74f47d8e04cf21", - "suricata.eve.fileinfo.sha1": "313573490192c685e9e53abef25453ed0d5e2aee", - "suricata.eve.fileinfo.sha256": "f610428ebddf6f8cf9e39322e672583c45fcdcf885efad0ab48fd53a3dfc2c4b", - "suricata.eve.fileinfo.size": 1071, - "suricata.eve.fileinfo.state": "CLOSED", - "suricata.eve.fileinfo.stored": false, - "suricata.eve.fileinfo.tx_id": 0, - "suricata.eve.flow_id": 2211411903323127, - "suricata.eve.http.hostname": "192.168.86.28", - "suricata.eve.http.http_content_type": "application/xml", - "suricata.eve.http.http_method": "GET", - "suricata.eve.http.http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", - "suricata.eve.http.length": 1071, - "suricata.eve.http.protocol": "HTTP/1.1", - "suricata.eve.http.status": 200, - "suricata.eve.http.url": "/ssdp/device-desc.xml", - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.86.28", - "suricata.eve.src_port": 8008, - "suricata.eve.timestamp": "2018-07-05T15:44:33.222441-0400", + "@timestamp": "2018-07-05T19:44:33.222Z", + "destination.domain": "192.168.86.28", + "destination.ip": "192.168.86.85", + "destination.port": 56118, + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:44:33.222Z", + "event.type": "fileinfo", + "file.path": "/ssdp/device-desc.xml", + "file.size": 1071, + "fileset.module": "suricata", + "fileset.name": "eve", + "http.request.method": "get", + "http.response.body.bytes": 1071, + "http.response.status_code": "200", + "input.type": "log", + "network.protocol": "http", + "network.transport": "tcp", + "offset": 1507, + "prospector.type": "log", + "source_ecs.ip": "192.168.86.28", + "source_ecs.port": 8008, + "suricata.eve.app_proto": "http", + "suricata.eve.dest_ip": "192.168.86.85", + "suricata.eve.dest_port": 56118, + "suricata.eve.event_type": "fileinfo", + "suricata.eve.fileinfo.filename": "/ssdp/device-desc.xml", + "suricata.eve.fileinfo.gaps": false, + "suricata.eve.fileinfo.md5": "427b7337ff37eeb24d74f47d8e04cf21", + "suricata.eve.fileinfo.sha1": "313573490192c685e9e53abef25453ed0d5e2aee", + "suricata.eve.fileinfo.sha256": "f610428ebddf6f8cf9e39322e672583c45fcdcf885efad0ab48fd53a3dfc2c4b", + "suricata.eve.fileinfo.size": 1071, + "suricata.eve.fileinfo.state": "CLOSED", + "suricata.eve.fileinfo.stored": false, + "suricata.eve.fileinfo.tx_id": 0, + "suricata.eve.flow_id": 2211411903323127, + "suricata.eve.http.hostname": "192.168.86.28", + "suricata.eve.http.http_content_type": "application/xml", + "suricata.eve.http.http_method": "GET", + "suricata.eve.http.http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36", + "suricata.eve.http.length": 1071, + "suricata.eve.http.protocol": "HTTP/1.1", + "suricata.eve.http.status": 200, + "suricata.eve.http.url": "/ssdp/device-desc.xml", + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.86.28", + "suricata.eve.src_port": 8008, + "suricata.eve.timestamp": "2018-07-05T15:44:33.222441-0400", "tags": [ "suricata" - ], - "url.hostname": "192.168.86.28", - "user_agent.device": "Other", - "user_agent.major": "67", - "user_agent.minor": "0", - "user_agent.name": "Chrome", - "user_agent.os.full_name": "Mac OS X 10.13.5", - "user_agent.os.major": "10", - "user_agent.os.minor": "13", - "user_agent.os.name": "Mac OS X", + ], + "url.domain": "192.168.86.28", + "url.path": "/ssdp/device-desc.xml", + "user_agent.device": "Other", + "user_agent.major": "67", + "user_agent.minor": "0", + "user_agent.name": "Chrome", + "user_agent.os.full_name": "Mac OS X 10.13.5", + "user_agent.os.major": "10", + "user_agent.os.minor": "13", + "user_agent.os.name": "Mac OS X", "user_agent.patch": "3396" - }, + }, { - "@timestamp": "2018-07-05T19:51:20.213Z", - "destination.ip": "192.168.86.85", - "destination.port": 39464, - "event.dataset": "suricata.eve", - "event.type": "dns", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 2347, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.1", - "source_ecs.port": 53, - "suricata.eve.dest_ip": "192.168.86.85", - "suricata.eve.dest_port": 39464, - "suricata.eve.dns.id": 12308, - "suricata.eve.dns.rcode": "NOERROR", - "suricata.eve.dns.rdata": "172.217.13.110", - "suricata.eve.dns.rrname": "clients.l.google.com", - "suricata.eve.dns.rrtype": "A", - "suricata.eve.dns.ttl": 299, - "suricata.eve.dns.type": "answer", - "suricata.eve.event_type": "dns", - "suricata.eve.flow_id": 1684780223079543, - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "UDP", - "suricata.eve.src_ip": "192.168.86.1", - "suricata.eve.src_port": 53, - "suricata.eve.timestamp": "2018-07-05T15:51:20.213418-0400", + "@timestamp": "2018-07-05T19:51:20.213Z", + "destination.ip": "192.168.86.85", + "destination.port": 39464, + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:51:20.213Z", + "event.type": "dns", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "network.transport": "udp", + "offset": 2347, + "prospector.type": "log", + "source_ecs.ip": "192.168.86.1", + "source_ecs.port": 53, + "suricata.eve.dest_ip": "192.168.86.85", + "suricata.eve.dest_port": 39464, + "suricata.eve.dns.id": 12308, + "suricata.eve.dns.rcode": "NOERROR", + "suricata.eve.dns.rdata": "172.217.13.110", + "suricata.eve.dns.rrname": "clients.l.google.com", + "suricata.eve.dns.rrtype": "A", + "suricata.eve.dns.ttl": 299, + "suricata.eve.dns.type": "answer", + "suricata.eve.event_type": "dns", + "suricata.eve.flow_id": 1684780223079543, + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "UDP", + "suricata.eve.src_ip": "192.168.86.1", + "suricata.eve.src_port": 53, + "suricata.eve.timestamp": "2018-07-05T15:51:20.213418-0400", "tags": [ "suricata" ] - }, + }, { - "@timestamp": "2018-07-05T19:51:23.009Z", - "event.dataset": "suricata.eve", - "event.type": "stats", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 2687, - "prospector.type": "log", - "suricata.eve.event_type": "stats", - "suricata.eve.stats.app_layer.flow.dcerpc_tcp": 0, - "suricata.eve.stats.app_layer.flow.dcerpc_udp": 0, - "suricata.eve.stats.app_layer.flow.dns_tcp": 0, - "suricata.eve.stats.app_layer.flow.dns_udp": 762, - "suricata.eve.stats.app_layer.flow.failed_tcp": 2, - "suricata.eve.stats.app_layer.flow.failed_udp": 1119, - "suricata.eve.stats.app_layer.flow.ftp": 0, - "suricata.eve.stats.app_layer.flow.http": 22, - "suricata.eve.stats.app_layer.flow.imap": 0, - "suricata.eve.stats.app_layer.flow.msn": 0, - "suricata.eve.stats.app_layer.flow.smb": 0, - "suricata.eve.stats.app_layer.flow.smtp": 0, - "suricata.eve.stats.app_layer.flow.ssh": 4, - "suricata.eve.stats.app_layer.flow.tls": 560, - "suricata.eve.stats.app_layer.tx.dcerpc_tcp": 0, - "suricata.eve.stats.app_layer.tx.dcerpc_udp": 0, - "suricata.eve.stats.app_layer.tx.dns_tcp": 0, - "suricata.eve.stats.app_layer.tx.dns_udp": 762, - "suricata.eve.stats.app_layer.tx.ftp": 0, - "suricata.eve.stats.app_layer.tx.http": 25, - "suricata.eve.stats.app_layer.tx.smb": 0, - "suricata.eve.stats.app_layer.tx.smtp": 0, - "suricata.eve.stats.app_layer.tx.ssh": 0, - "suricata.eve.stats.app_layer.tx.tls": 0, - "suricata.eve.stats.capture.kernel_drops": 0, - "suricata.eve.stats.capture.kernel_ifdrops": 0, - "suricata.eve.stats.capture.kernel_packets": 430313, - "suricata.eve.stats.decoder.avg_pkt_size": 778, - "suricata.eve.stats.decoder.bytes": 335138381, - "suricata.eve.stats.decoder.dce.pkt_too_small": 0, - "suricata.eve.stats.decoder.erspan": 0, - "suricata.eve.stats.decoder.ethernet": 430313, - "suricata.eve.stats.decoder.gre": 0, - "suricata.eve.stats.decoder.icmpv4": 186, - "suricata.eve.stats.decoder.icmpv6": 1019, - "suricata.eve.stats.decoder.ieee8021ah": 0, - "suricata.eve.stats.decoder.invalid": 2, - "suricata.eve.stats.decoder.ipraw.invalid_ip_version": 0, - "suricata.eve.stats.decoder.ipv4": 425873, - "suricata.eve.stats.decoder.ipv4_in_ipv6": 0, - "suricata.eve.stats.decoder.ipv6": 3785, - "suricata.eve.stats.decoder.ipv6_in_ipv6": 0, - "suricata.eve.stats.decoder.ltnull.pkt_too_small": 0, - "suricata.eve.stats.decoder.ltnull.unsupported_type": 0, - "suricata.eve.stats.decoder.max_pkt_size": 1514, - "suricata.eve.stats.decoder.mpls": 0, - "suricata.eve.stats.decoder.null": 0, - "suricata.eve.stats.decoder.pkts": 430313, - "suricata.eve.stats.decoder.ppp": 0, - "suricata.eve.stats.decoder.pppoe": 0, - "suricata.eve.stats.decoder.raw": 0, - "suricata.eve.stats.decoder.sctp": 0, - "suricata.eve.stats.decoder.sll": 0, - "suricata.eve.stats.decoder.tcp": 370093, - "suricata.eve.stats.decoder.teredo": 1, - "suricata.eve.stats.decoder.udp": 58337, - "suricata.eve.stats.decoder.vlan": 0, - "suricata.eve.stats.decoder.vlan_qinq": 0, - "suricata.eve.stats.defrag.ipv4.fragments": 0, - "suricata.eve.stats.defrag.ipv4.reassembled": 0, - "suricata.eve.stats.defrag.ipv4.timeouts": 0, - "suricata.eve.stats.defrag.ipv6.fragments": 0, - "suricata.eve.stats.defrag.ipv6.reassembled": 0, - "suricata.eve.stats.defrag.ipv6.timeouts": 0, - "suricata.eve.stats.defrag.max_frag_hits": 0, - "suricata.eve.stats.detect.alert": 2, - "suricata.eve.stats.dns.memcap_global": 0, - "suricata.eve.stats.dns.memcap_state": 0, - "suricata.eve.stats.dns.memuse": 7749, - "suricata.eve.stats.file_store.open_files": 0, - "suricata.eve.stats.flow.emerg_mode_entered": 0, - "suricata.eve.stats.flow.emerg_mode_over": 0, - "suricata.eve.stats.flow.icmpv4": 0, - "suricata.eve.stats.flow.icmpv6": 677, - "suricata.eve.stats.flow.memcap": 0, - "suricata.eve.stats.flow.memuse": 11537312, - "suricata.eve.stats.flow.spare": 10000, - "suricata.eve.stats.flow.tcp": 1113, - "suricata.eve.stats.flow.tcp_reuse": 0, - "suricata.eve.stats.flow.udp": 1881, - "suricata.eve.stats.flow_mgr.bypassed_pruned": 0, - "suricata.eve.stats.flow_mgr.closed_pruned": 729, - "suricata.eve.stats.flow_mgr.est_pruned": 975, - "suricata.eve.stats.flow_mgr.flows_checked": 8, - "suricata.eve.stats.flow_mgr.flows_notimeout": 8, - "suricata.eve.stats.flow_mgr.flows_removed": 0, - "suricata.eve.stats.flow_mgr.flows_timeout": 0, - "suricata.eve.stats.flow_mgr.flows_timeout_inuse": 0, - "suricata.eve.stats.flow_mgr.new_pruned": 1879, - "suricata.eve.stats.flow_mgr.rows_busy": 0, - "suricata.eve.stats.flow_mgr.rows_checked": 65536, - "suricata.eve.stats.flow_mgr.rows_empty": 0, - "suricata.eve.stats.flow_mgr.rows_maxlen": 2, - "suricata.eve.stats.flow_mgr.rows_skipped": 65530, - "suricata.eve.stats.http.memcap": 0, - "suricata.eve.stats.http.memuse": 17861, - "suricata.eve.stats.tcp.insert_data_normal_fail": 0, - "suricata.eve.stats.tcp.insert_data_overlap_fail": 0, - "suricata.eve.stats.tcp.insert_list_fail": 0, - "suricata.eve.stats.tcp.invalid_checksum": 0, - "suricata.eve.stats.tcp.memuse": 4587520, - "suricata.eve.stats.tcp.no_flow": 0, - "suricata.eve.stats.tcp.overlap": 5979, - "suricata.eve.stats.tcp.overlap_diff_data": 0, - "suricata.eve.stats.tcp.pseudo": 0, - "suricata.eve.stats.tcp.pseudo_failed": 0, - "suricata.eve.stats.tcp.reassembly_gap": 0, - "suricata.eve.stats.tcp.reassembly_memuse": 768000, - "suricata.eve.stats.tcp.rst": 1165, - "suricata.eve.stats.tcp.segment_memcap_drop": 0, - "suricata.eve.stats.tcp.sessions": 842, - "suricata.eve.stats.tcp.ssn_memcap_drop": 0, - "suricata.eve.stats.tcp.stream_depth_reached": 63, - "suricata.eve.stats.tcp.syn": 1138, - "suricata.eve.stats.tcp.synack": 656, - "suricata.eve.stats.uptime": 5400, - "suricata.eve.timestamp": "2018-07-05T15:51:23.009510-0400", + "@timestamp": "2018-07-05T19:51:23.009Z", + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:51:23.009Z", + "event.type": "stats", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "offset": 2687, + "prospector.type": "log", + "suricata.eve.event_type": "stats", + "suricata.eve.stats.app_layer.flow.dcerpc_tcp": 0, + "suricata.eve.stats.app_layer.flow.dcerpc_udp": 0, + "suricata.eve.stats.app_layer.flow.dns_tcp": 0, + "suricata.eve.stats.app_layer.flow.dns_udp": 762, + "suricata.eve.stats.app_layer.flow.failed_tcp": 2, + "suricata.eve.stats.app_layer.flow.failed_udp": 1119, + "suricata.eve.stats.app_layer.flow.ftp": 0, + "suricata.eve.stats.app_layer.flow.http": 22, + "suricata.eve.stats.app_layer.flow.imap": 0, + "suricata.eve.stats.app_layer.flow.msn": 0, + "suricata.eve.stats.app_layer.flow.smb": 0, + "suricata.eve.stats.app_layer.flow.smtp": 0, + "suricata.eve.stats.app_layer.flow.ssh": 4, + "suricata.eve.stats.app_layer.flow.tls": 560, + "suricata.eve.stats.app_layer.tx.dcerpc_tcp": 0, + "suricata.eve.stats.app_layer.tx.dcerpc_udp": 0, + "suricata.eve.stats.app_layer.tx.dns_tcp": 0, + "suricata.eve.stats.app_layer.tx.dns_udp": 762, + "suricata.eve.stats.app_layer.tx.ftp": 0, + "suricata.eve.stats.app_layer.tx.http": 25, + "suricata.eve.stats.app_layer.tx.smb": 0, + "suricata.eve.stats.app_layer.tx.smtp": 0, + "suricata.eve.stats.app_layer.tx.ssh": 0, + "suricata.eve.stats.app_layer.tx.tls": 0, + "suricata.eve.stats.capture.kernel_drops": 0, + "suricata.eve.stats.capture.kernel_ifdrops": 0, + "suricata.eve.stats.capture.kernel_packets": 430313, + "suricata.eve.stats.decoder.avg_pkt_size": 778, + "suricata.eve.stats.decoder.bytes": 335138381, + "suricata.eve.stats.decoder.dce.pkt_too_small": 0, + "suricata.eve.stats.decoder.erspan": 0, + "suricata.eve.stats.decoder.ethernet": 430313, + "suricata.eve.stats.decoder.gre": 0, + "suricata.eve.stats.decoder.icmpv4": 186, + "suricata.eve.stats.decoder.icmpv6": 1019, + "suricata.eve.stats.decoder.ieee8021ah": 0, + "suricata.eve.stats.decoder.invalid": 2, + "suricata.eve.stats.decoder.ipraw.invalid_ip_version": 0, + "suricata.eve.stats.decoder.ipv4": 425873, + "suricata.eve.stats.decoder.ipv4_in_ipv6": 0, + "suricata.eve.stats.decoder.ipv6": 3785, + "suricata.eve.stats.decoder.ipv6_in_ipv6": 0, + "suricata.eve.stats.decoder.ltnull.pkt_too_small": 0, + "suricata.eve.stats.decoder.ltnull.unsupported_type": 0, + "suricata.eve.stats.decoder.max_pkt_size": 1514, + "suricata.eve.stats.decoder.mpls": 0, + "suricata.eve.stats.decoder.null": 0, + "suricata.eve.stats.decoder.pkts": 430313, + "suricata.eve.stats.decoder.ppp": 0, + "suricata.eve.stats.decoder.pppoe": 0, + "suricata.eve.stats.decoder.raw": 0, + "suricata.eve.stats.decoder.sctp": 0, + "suricata.eve.stats.decoder.sll": 0, + "suricata.eve.stats.decoder.tcp": 370093, + "suricata.eve.stats.decoder.teredo": 1, + "suricata.eve.stats.decoder.udp": 58337, + "suricata.eve.stats.decoder.vlan": 0, + "suricata.eve.stats.decoder.vlan_qinq": 0, + "suricata.eve.stats.defrag.ipv4.fragments": 0, + "suricata.eve.stats.defrag.ipv4.reassembled": 0, + "suricata.eve.stats.defrag.ipv4.timeouts": 0, + "suricata.eve.stats.defrag.ipv6.fragments": 0, + "suricata.eve.stats.defrag.ipv6.reassembled": 0, + "suricata.eve.stats.defrag.ipv6.timeouts": 0, + "suricata.eve.stats.defrag.max_frag_hits": 0, + "suricata.eve.stats.detect.alert": 2, + "suricata.eve.stats.dns.memcap_global": 0, + "suricata.eve.stats.dns.memcap_state": 0, + "suricata.eve.stats.dns.memuse": 7749, + "suricata.eve.stats.file_store.open_files": 0, + "suricata.eve.stats.flow.emerg_mode_entered": 0, + "suricata.eve.stats.flow.emerg_mode_over": 0, + "suricata.eve.stats.flow.icmpv4": 0, + "suricata.eve.stats.flow.icmpv6": 677, + "suricata.eve.stats.flow.memcap": 0, + "suricata.eve.stats.flow.memuse": 11537312, + "suricata.eve.stats.flow.spare": 10000, + "suricata.eve.stats.flow.tcp": 1113, + "suricata.eve.stats.flow.tcp_reuse": 0, + "suricata.eve.stats.flow.udp": 1881, + "suricata.eve.stats.flow_mgr.bypassed_pruned": 0, + "suricata.eve.stats.flow_mgr.closed_pruned": 729, + "suricata.eve.stats.flow_mgr.est_pruned": 975, + "suricata.eve.stats.flow_mgr.flows_checked": 8, + "suricata.eve.stats.flow_mgr.flows_notimeout": 8, + "suricata.eve.stats.flow_mgr.flows_removed": 0, + "suricata.eve.stats.flow_mgr.flows_timeout": 0, + "suricata.eve.stats.flow_mgr.flows_timeout_inuse": 0, + "suricata.eve.stats.flow_mgr.new_pruned": 1879, + "suricata.eve.stats.flow_mgr.rows_busy": 0, + "suricata.eve.stats.flow_mgr.rows_checked": 65536, + "suricata.eve.stats.flow_mgr.rows_empty": 0, + "suricata.eve.stats.flow_mgr.rows_maxlen": 2, + "suricata.eve.stats.flow_mgr.rows_skipped": 65530, + "suricata.eve.stats.http.memcap": 0, + "suricata.eve.stats.http.memuse": 17861, + "suricata.eve.stats.tcp.insert_data_normal_fail": 0, + "suricata.eve.stats.tcp.insert_data_overlap_fail": 0, + "suricata.eve.stats.tcp.insert_list_fail": 0, + "suricata.eve.stats.tcp.invalid_checksum": 0, + "suricata.eve.stats.tcp.memuse": 4587520, + "suricata.eve.stats.tcp.no_flow": 0, + "suricata.eve.stats.tcp.overlap": 5979, + "suricata.eve.stats.tcp.overlap_diff_data": 0, + "suricata.eve.stats.tcp.pseudo": 0, + "suricata.eve.stats.tcp.pseudo_failed": 0, + "suricata.eve.stats.tcp.reassembly_gap": 0, + "suricata.eve.stats.tcp.reassembly_memuse": 768000, + "suricata.eve.stats.tcp.rst": 1165, + "suricata.eve.stats.tcp.segment_memcap_drop": 0, + "suricata.eve.stats.tcp.sessions": 842, + "suricata.eve.stats.tcp.ssn_memcap_drop": 0, + "suricata.eve.stats.tcp.stream_depth_reached": 63, + "suricata.eve.stats.tcp.syn": 1138, + "suricata.eve.stats.tcp.synack": 656, + "suricata.eve.stats.uptime": 5400, + "suricata.eve.timestamp": "2018-07-05T15:51:23.009510-0400", "tags": [ "suricata" ] - }, + }, { - "@timestamp": "2018-07-05T19:51:50.666Z", - "destination.geo.continent_name": "North America", - "destination.geo.country_iso_code": "US", - "destination.geo.location.lat": 37.751, - "destination.geo.location.lon": -97.822, - "destination.ip": "17.142.164.13", - "destination.port": 443, - "event.dataset": "suricata.eve", - "event.type": "tls", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 4683, - "prospector.type": "log", - "source_ecs.ip": "192.168.86.85", - "source_ecs.port": 56187, - "suricata.eve.dest_ip": "17.142.164.13", - "suricata.eve.dest_port": 443, - "suricata.eve.event_type": "tls", - "suricata.eve.flow_id": 89751777876473, - "suricata.eve.in_iface": "en0", - "suricata.eve.proto": "TCP", - "suricata.eve.src_ip": "192.168.86.85", - "suricata.eve.src_port": 56187, - "suricata.eve.timestamp": "2018-07-05T15:51:50.666597-0400", - "suricata.eve.tls.fingerprint": "6a:ff:ac:a6:5f:8a:05:e7:a9:8c:76:29:b9:08:c7:69:ad:dc:72:47", - "suricata.eve.tls.issuerdn": "CN=Apple IST CA 2 - G1/OU=Certification Authority/O=Apple Inc./C=US", - "suricata.eve.tls.notafter": "2019-03-29T17:54:31", - "suricata.eve.tls.notbefore": "2017-02-27T17:54:31", - "suricata.eve.tls.serial": "5C:9C:E1:09:78:87:F8:07", - "suricata.eve.tls.sni": "p33-btmmdns.icloud.com.", - "suricata.eve.tls.subject": "CN=*.icloud.com/OU=management:idms.group.506364/O=Apple Inc./ST=California/C=US", - "suricata.eve.tls.version": "TLS 1.2", + "@timestamp": "2018-07-05T19:51:50.666Z", + "destination.geo.continent_name": "North America", + "destination.geo.country_iso_code": "US", + "destination.geo.location.lat": 37.751, + "destination.geo.location.lon": -97.822, + "destination.ip": "17.142.164.13", + "destination.port": 443, + "event.dataset": "suricata.eve", + "event.end": "2018-07-05T19:51:50.666Z", + "event.type": "tls", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "network.transport": "tcp", + "offset": 4683, + "prospector.type": "log", + "source_ecs.ip": "192.168.86.85", + "source_ecs.port": 56187, + "suricata.eve.dest_ip": "17.142.164.13", + "suricata.eve.dest_port": 443, + "suricata.eve.event_type": "tls", + "suricata.eve.flow_id": 89751777876473, + "suricata.eve.in_iface": "en0", + "suricata.eve.proto": "TCP", + "suricata.eve.src_ip": "192.168.86.85", + "suricata.eve.src_port": 56187, + "suricata.eve.timestamp": "2018-07-05T15:51:50.666597-0400", + "suricata.eve.tls.fingerprint": "6a:ff:ac:a6:5f:8a:05:e7:a9:8c:76:29:b9:08:c7:69:ad:dc:72:47", + "suricata.eve.tls.issuerdn": "CN=Apple IST CA 2 - G1/OU=Certification Authority/O=Apple Inc./C=US", + "suricata.eve.tls.notafter": "2019-03-29T17:54:31", + "suricata.eve.tls.notbefore": "2017-02-27T17:54:31", + "suricata.eve.tls.serial": "5C:9C:E1:09:78:87:F8:07", + "suricata.eve.tls.sni": "p33-btmmdns.icloud.com.", + "suricata.eve.tls.subject": "CN=*.icloud.com/OU=management:idms.group.506364/O=Apple Inc./ST=California/C=US", + "suricata.eve.tls.version": "TLS 1.2", "tags": [ "suricata" ] - }, + }, { - "@timestamp": "2018-07-05T19:51:54.001Z", - "destination.ip": "ff02:0000:0000:0000:0000:0000:0001:0002", - "destination.port": 547, - "event.dataset": "suricata.eve", - "event.type": "flow", - "fileset.module": "suricata", - "fileset.name": "eve", - "input.type": "log", - "offset": 5308, - "prospector.type": "log", - "source_ecs.ip": "fe80:0000:0000:0000:fada:0cff:fedc:87f1", - "source_ecs.port": 546, - "suricata.eve.app_proto": "failed", - "suricata.eve.dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", - "suricata.eve.dest_port": 547, - "suricata.eve.event_type": "flow", - "suricata.eve.flow.age": 0, - "suricata.eve.flow.alerted": false, - "suricata.eve.flow.bytes_toclient": 0, - "suricata.eve.flow.bytes_toserver": 110, - "suricata.eve.flow.end": "2018-07-05T15:51:23.453468-0400", - "suricata.eve.flow.pkts_toclient": 0, - "suricata.eve.flow.pkts_toserver": 1, - "suricata.eve.flow.reason": "timeout", - "suricata.eve.flow.start": "2018-07-05T15:51:23.453468-0400", - "suricata.eve.flow.state": "new", - "suricata.eve.flow_id": 1828507008887644, - "suricata.eve.proto": "UDP", - "suricata.eve.src_ip": "fe80:0000:0000:0000:fada:0cff:fedc:87f1", - "suricata.eve.src_port": 546, - "suricata.eve.timestamp": "2018-07-05T15:51:54.001329-0400", + "@timestamp": "2018-07-05T19:51:54.001Z", + "destination.bytes": 0, + "destination.ip": "ff02:0000:0000:0000:0000:0000:0001:0002", + "destination.packets": 0, + "destination.port": 547, + "event.dataset": "suricata.eve", + "event.duration": 30548000000, + "event.end": "2018-07-05T19:51:54.001Z", + "event.start": "2018-07-05T19:51:23.453Z", + "event.type": "flow", + "fileset.module": "suricata", + "fileset.name": "eve", + "input.type": "log", + "network.bytes": 110, + "network.packets": 1, + "network.protocol": "failed", + "network.transport": "udp", + "offset": 5308, + "prospector.type": "log", + "source_ecs.bytes": 110, + "source_ecs.ip": "fe80:0000:0000:0000:fada:0cff:fedc:87f1", + "source_ecs.packets": 1, + "source_ecs.port": 546, + "suricata.eve.app_proto": "failed", + "suricata.eve.dest_ip": "ff02:0000:0000:0000:0000:0000:0001:0002", + "suricata.eve.dest_port": 547, + "suricata.eve.event_type": "flow", + "suricata.eve.flow.age": 0, + "suricata.eve.flow.alerted": false, + "suricata.eve.flow.bytes_toclient": 0, + "suricata.eve.flow.bytes_toserver": 110, + "suricata.eve.flow.end": "2018-07-05T15:51:23.453468-0400", + "suricata.eve.flow.pkts_toclient": 0, + "suricata.eve.flow.pkts_toserver": 1, + "suricata.eve.flow.reason": "timeout", + "suricata.eve.flow.start": "2018-07-05T15:51:23.453468-0400", + "suricata.eve.flow.state": "new", + "suricata.eve.flow_id": 1828507008887644, + "suricata.eve.proto": "UDP", + "suricata.eve.src_ip": "fe80:0000:0000:0000:fada:0cff:fedc:87f1", + "suricata.eve.src_port": 546, + "suricata.eve.timestamp": "2018-07-05T15:51:54.001329-0400", "tags": [ "suricata" ]