eve.json - Suricata - Open Information Security Foundation

Bug #8811 » eve.json

Egor Kotov, 08/05/2026 07:15 PM

    
    {"timestamp":"2026-08-05T17:05:52.212828+0300","flow_id":63477540176945,"pcap_cnt":16,"event_type":"anomaly","src_ip":"192.168.57.135","src_port":38673,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"anomaly":{"app_proto":"ldap","type":"applayer","event":"request_not_found","layer":"proto_parser"}}

    {"timestamp":"2026-08-05T17:05:52.212828+0300","flow_id":63477540176945,"pcap_cnt":16,"event_type":"ldap","src_ip":"192.168.57.135","src_port":38673,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"responses":[{"operation":"bind_response","message_id":4,"bind_response":{"result_code":"success","matched_dn":"NTLM","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.213729+0300","flow_id":63477540176945,"pcap_cnt":18,"event_type":"anomaly","src_ip":"192.168.57.129","src_port":389,"dest_ip":"192.168.57.135","dest_port":38673,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","anomaly":{"app_proto":"ldap","type":"applayer","event":"APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION","layer":"proto_detect"}}

    {"timestamp":"2026-08-05T17:05:52.208436+0300","flow_id":45414234469455,"pcap_cnt":6,"event_type":"ldap","src_ip":"192.168.57.135","src_port":58357,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":1,"operation":"bind_request","bind_request":{"version":3,"name":""}},"responses":[{"operation":"bind_response","bind_response":{"result_code":"success","matched_dn":"","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.209532+0300","flow_id":45414234469455,"pcap_cnt":9,"event_type":"ldap","src_ip":"192.168.57.135","src_port":58357,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":2,"operation":"search_request","search_request":{"base_object":"","scope":0,"deref_alias":3,"size_limit":0,"time_limit":0,"types_only":false,"filter":{"type":"present","value":"objectClass"},"attributes":["subschemaSubentry","+"]}},"responses":[{"operation":"search_result_entry","search_result_entry":{"base_object":"","attributes":[{"type":"subschemaSubentry","values":["CN=Aggregate,CN=Schema,CN=Configuration,DC=corp,DC=local"]}]}},{"operation":"search_result_done","search_result_done":{"result_code":"success","matched_dn":"","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.251150+0300","flow_id":45414234469455,"pcap_cnt":85,"event_type":"ldap","src_ip":"192.168.57.135","src_port":58357,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":3,"operation":"search_request","search_request":{"base_object":"CN=Aggregate,CN=Schema,CN=Configuration,DC=corp,DC=local","scope":0,"deref_alias":3,"size_limit":0,"time_limit":0,"types_only":false,"attributes":["objectClasses","attributeTypes","ldapSyntaxes","matchingRules","matchingRuleUse","dITContentRules","dITStructureRules","nameForms","createTimestamp","modifyTimestamp","*","+"]}},"responses":[{"operation":"search_result_done","search_result_done":{"result_code":"operations_error","matched_dn":"","message":"000004DC: LdapErr: DSID-0C090A58, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c\u0000"}}]}}

    {"timestamp":"2026-08-05T17:05:52.392406+0300","flow_id":268000459334057,"pcap_cnt":246,"event_type":"ldap","src_ip":"192.168.57.135","src_port":45175,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":31,"operation":"bind_request","bind_request":{"version":3,"name":""}},"responses":[{"operation":"bind_response","bind_response":{"result_code":"success","matched_dn":"","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.403857+0300","flow_id":31398767521987,"pcap_cnt":256,"event_type":"anomaly","src_ip":"192.168.57.135","src_port":54237,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","tx_id":0,"anomaly":{"app_proto":"ldap","type":"applayer","event":"request_not_found","layer":"proto_parser"}}

    {"timestamp":"2026-08-05T17:05:52.403857+0300","flow_id":31398767521987,"pcap_cnt":256,"event_type":"ldap","src_ip":"192.168.57.135","src_port":54237,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"responses":[{"operation":"bind_response","message_id":34,"bind_response":{"result_code":"success","matched_dn":"NTLM","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.404544+0300","flow_id":31398767521987,"pcap_cnt":258,"event_type":"anomaly","src_ip":"192.168.57.129","src_port":389,"dest_ip":"192.168.57.135","dest_port":54237,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","anomaly":{"app_proto":"ldap","type":"applayer","event":"APPLAYER_DETECT_PROTOCOL_ONLY_ONE_DIRECTION","layer":"proto_detect"}}

    {"timestamp":"2026-08-05T17:05:52.394487+0300","flow_id":268000459334057,"pcap_cnt":249,"event_type":"ldap","src_ip":"192.168.57.135","src_port":45175,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":32,"operation":"search_request","search_request":{"base_object":"","scope":0,"deref_alias":3,"size_limit":0,"time_limit":0,"types_only":false,"filter":{"type":"present","value":"objectClass"},"attributes":["subschemaSubentry","+"]}},"responses":[{"operation":"search_result_entry","search_result_entry":{"base_object":"","attributes":[{"type":"subschemaSubentry","values":["CN=Aggregate,CN=Schema,CN=Configuration,DC=corp,DC=local"]}]}},{"operation":"search_result_done","search_result_done":{"result_code":"success","matched_dn":"","message":""}}]}}

    {"timestamp":"2026-08-05T17:05:52.438820+0300","flow_id":268000459334057,"pcap_cnt":332,"event_type":"ldap","src_ip":"192.168.57.135","src_port":45175,"dest_ip":"192.168.57.129","dest_port":389,"proto":"TCP","ip_v":4,"pkt_src":"wire/pcap","ldap":{"request":{"message_id":33,"operation":"search_request","search_request":{"base_object":"CN=Aggregate,CN=Schema,CN=Configuration,DC=corp,DC=local","scope":0,"deref_alias":3,"size_limit":0,"time_limit":0,"types_only":false,"attributes":["objectClasses","attributeTypes","ldapSyntaxes","matchingRules","matchingRuleUse","dITContentRules","dITStructureRules","nameForms","createTimestamp","modifyTimestamp","*","+"]}},"responses":[{"operation":"search_result_done","search_result_done":{"result_code":"operations_error","matched_dn":"","message":"000004DC: LdapErr: DSID-0C090A58, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4f7c\u0000"}}]}}

    {"timestamp":"2026-08-05T17:05:52.207181+0300","flow_id":45414234469455,"event_type":"flow","src_ip":"192.168.57.135","src_port":58357,"dest_ip":"192.168.57.129","dest_port":389,"ip_v":4,"proto":"TCP","app_proto":"ldap","flow":{"pkts_toserver":8,"pkts_toclient":6,"bytes_toserver":888,"bytes_toclient":728,"start":"2026-08-05T17:05:52.207181+0300","end":"2026-08-05T17:05:52.430777+0300","age":0,"state":"closed","reason":"shutdown","alerted":false,"tx_cnt":3},"tcp":{"tcp_flags":"1f","tcp_flags_ts":"1b","tcp_flags_tc":"1e","syn":true,"fin":true,"rst":true,"psh":true,"ack":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}

    {"timestamp":"2026-08-05T17:05:52.207181+0300","flow_id":31398767521987,"event_type":"flow","src_ip":"192.168.57.135","src_port":54237,"dest_ip":"192.168.57.129","dest_port":389,"ip_v":4,"proto":"TCP","app_proto":"ldap","flow":{"pkts_toserver":59,"pkts_toclient":54,"bytes_toserver":7740,"bytes_toclient":319872,"start":"2026-08-05T17:05:52.400526+0300","end":"2026-08-05T17:05:52.579458+0300","age":0,"state":"closed","reason":"shutdown","alerted":false,"exception_policy":[{"target":"app_layer_error","policy":"ignore"}],"tx_cnt":1},"tcp":{"tcp_flags":"1f","tcp_flags_ts":"1b","tcp_flags_tc":"1e","syn":true,"fin":true,"rst":true,"psh":true,"ack":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}

    {"timestamp":"2026-08-05T17:05:52.207181+0300","flow_id":268000459334057,"event_type":"flow","src_ip":"192.168.57.135","src_port":45175,"dest_ip":"192.168.57.129","dest_port":389,"ip_v":4,"proto":"TCP","app_proto":"ldap","flow":{"pkts_toserver":8,"pkts_toclient":6,"bytes_toserver":888,"bytes_toclient":728,"start":"2026-08-05T17:05:52.390078+0300","end":"2026-08-05T17:05:52.579458+0300","age":0,"state":"closed","reason":"shutdown","alerted":false,"tx_cnt":3},"tcp":{"tcp_flags":"1f","tcp_flags_ts":"1b","tcp_flags_tc":"1e","syn":true,"fin":true,"rst":true,"psh":true,"ack":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}

    {"timestamp":"2026-08-05T17:05:52.207181+0300","flow_id":63477540176945,"event_type":"flow","src_ip":"192.168.57.135","src_port":38673,"dest_ip":"192.168.57.129","dest_port":389,"ip_v":4,"proto":"TCP","app_proto":"ldap","flow":{"pkts_toserver":142,"pkts_toclient":133,"bytes_toserver":24031,"bytes_toclient":766436,"start":"2026-08-05T17:05:52.211387+0300","end":"2026-08-05T17:05:52.579458+0300","age":0,"state":"closed","reason":"shutdown","alerted":false,"exception_policy":[{"target":"app_layer_error","policy":"ignore"}],"tx_cnt":1},"tcp":{"tcp_flags":"1f","tcp_flags_ts":"1b","tcp_flags_tc":"1e","syn":true,"fin":true,"rst":true,"psh":true,"ack":true,"state":"closed","ts_max_regions":1,"tc_max_regions":1}}

    {"timestamp":"2026-08-05T22:12:24.159735+0300","event_type":"stats","stats":{"uptime":1,"decoder":{"pkts":416,"bytes":1121311,"invalid":0,"ipv4":416,"ipv6":0,"ethernet":416,"arp":0,"unknown_ethertype":0,"chdlc":0,"raw":0,"null":0,"sll":0,"sll2":0,"tcp":416,"udp":0,"sctp":0,"esp":0,"icmpv4":0,"icmpv6":0,"ppp":0,"pppoe":0,"geneve":0,"gre":0,"vlan":0,"vlan_qinq":0,"vlan_qinqinq":0,"vxlan":0,"vntag":0,"ieee8021ah":0,"teredo":0,"ipv4_in_ipv4":0,"ipv6_in_ipv4":0,"ipv4_in_ipv6":0,"ipv6_in_ipv6":0,"mpls":0,"avg_pkt_size":2695,"max_pkt_size":52194,"max_mac_addrs_src":0,"max_mac_addrs_dst":0,"erspan":0,"nsh":0,"event":{"afpacket":{"trunc_pkt":0},"ipv4":{"pkt_too_small":0,"hlen_too_small":0,"iplen_smaller_than_hlen":0,"trunc_pkt":0,"opt_invalid":0,"opt_invalid_len":0,"opt_malformed":0,"opt_pad_required":0,"opt_eol_required":0,"opt_duplicate":0,"opt_unknown":0,"wrong_ip_version":0,"icmpv6":0,"frag_pkt_too_large":0,"frag_overlap":0,"frag_ignored":0},"icmpv4":{"pkt_too_small":0,"unknown_type":0,"unknown_code":0,"ipv4_trunc_pkt":0,"ipv4_unknown_ver":0},"icmpv6":{"unknown_type":0,"unknown_code":0,"pkt_too_small":0,"ipv6_unknown_version":0,"ipv6_trunc_pkt":0,"mld_message_with_invalid_hl":0,"unassigned_type":0,"experimentation_type":0},"ipv6":{"pkt_too_small":0,"trunc_pkt":0,"trunc_exthdr":0,"exthdr_dupl_fh":0,"exthdr_useless_fh":0,"exthdr_dupl_rh":0,"exthdr_dupl_hh":0,"exthdr_dupl_dh":0,"exthdr_dupl_ah":0,"exthdr_dupl_eh":0,"exthdr_invalid_optlen":0,"wrong_ip_version":0,"exthdr_ah_res_not_null":0,"hopopts_unknown_opt":0,"hopopts_only_padding":0,"dstopts_unknown_opt":0,"dstopts_only_padding":0,"rh_type_0":0,"zero_len_padn":0,"fh_non_zero_reserved_field":0,"data_after_none_header":0,"unknown_next_header":0,"icmpv4":0,"frag_pkt_too_large":0,"frag_overlap":0,"frag_invalid_length":0,"frag_ignored":0,"ipv4_in_ipv6_too_small":0,"ipv4_in_ipv6_wrong_version":0,"ipv6_in_ipv6_too_small":0,"ipv6_in_ipv6_wrong_version":0},"tcp":{"pkt_too_small":0,"hlen_too_small":0,"invalid_optlen":0,"opt_invalid_len":0,"opt_duplicate":0},"udp":{"pkt_too_small":0,"hlen_too_small":0,"hlen_invalid":0,"len_invalid":0},"sll":{"pkt_too_small":0},"sll2":{"pkt_too_small":0},"ethernet":{"pkt_too_small":0,"unknown_ethertype":0},"ppp":{"pkt_too_small":0,"vju_pkt_too_small":0,"ip4_pkt_too_small":0,"ip6_pkt_too_small":0,"wrong_type":0,"unsup_proto":0},"pppoe":{"pkt_too_small":0,"wrong_code":0,"malformed_tags":0},"gre":{"pkt_too_small":0,"wrong_version":0,"version0_recur":0,"version0_flags":0,"version0_hdr_too_big":0,"version0_malformed_sre_hdr":0,"version1_chksum":0,"version1_route":0,"version1_ssr":0,"version1_recur":0,"version1_flags":0,"version1_no_key":0,"version1_wrong_protocol":0,"version1_malformed_sre_hdr":0,"version1_hdr_too_big":0},"vlan":{"header_too_small":0,"unknown_type":0,"too_many_layers":0},"ieee8021ah":{"header_too_small":0},"vntag":{"header_too_small":0,"unknown_type":0},"ipraw":{"invalid_ip_version":0},"ltnull":{"pkt_too_small":0,"unsupported_type":0},"sctp":{"pkt_too_small":0},"esp":{"pkt_too_small":0},"mpls":{"header_too_small":0,"pkt_too_small":0,"bad_label_router_alert":0,"bad_label_implicit_null":0,"bad_label_reserved":0,"unknown_payload_type":0},"vxlan":{"unknown_payload_type":0},"geneve":{"unknown_payload_type":0},"erspan":{"header_too_small":0,"unsupported_version":0,"too_many_vlan_layers":0},"dce":{"pkt_too_small":0},"chdlc":{"pkt_too_small":0},"nsh":{"header_too_small":0,"unsupported_version":0,"bad_header_length":0,"reserved_type":0,"unsupported_type":0,"unknown_payload":0}},"too_many_layers":0},"tcp":{"syn":4,"synack":4,"rst":4,"urg":0,"active_sessions":0,"sessions":4,"ssn_memcap_drop":0,"ssn_from_cache":0,"ssn_from_pool":4,"pseudo":0,"invalid_checksum":0,"midstream_pickups":0,"pkt_on_wrong_thread":0,"ack_unseen_data":0,"segment_memcap_drop":0,"segment_from_cache":42,"segment_from_pool":24,"stream_depth_reached":0,"reassembly_gap":0,"overlap":0,"overlap_diff_data":0,"insert_data_normal_fail":0,"insert_data_overlap_fail":0,"urgent_oob_data":0,"memuse":3735552,"reassembly_memuse":688128},"flow":{"memcap":0,"total":4,"active":0,"tcp":4,"udp":0,"icmpv4":0,"icmpv6":0,"tcp_reuse":0,"elephant":0,"get_used":0,"get_used_eval":0,"get_used_eval_reject":0,"get_used_eval_busy":0,"get_used_failed":0,"wrk":{"spare_sync_avg":100,"spare_sync":2,"spare_sync_incomplete":0,"spare_sync_empty":0,"flows_evicted_needs_work":0,"flows_evicted_pkt_inject":0,"flows_evicted":0,"flows_injected":0,"flows_injected_max":0},"end":{"state":{"new":0,"established":0,"closed":4,"local_bypassed":0},"tcp_state":{"none":0,"syn_sent":0,"syn_recv":0,"established":0,"fin_wait1":0,"fin_wait2":0,"time_wait":0,"last_ack":0,"close_wait":0,"closing":0,"closed":4},"tcp_liberal":0},"mgr":{"full_hash_pass":0,"rows_per_sec":6553,"rows_maxlen":0,"flows_checked":0,"flows_notimeout":0,"flows_timeout":0,"flows_evicted":0,"flows_evicted_needs_work":0},"spare":9900,"emerg_mode_entered":0,"emerg_mode_over":0,"recycler":{"recycled":4,"queue_avg":0,"queue_max":4},"memuse":7154304},"defrag":{"ipv4":{"fragments":0,"reassembled":0},"ipv6":{"fragments":0,"reassembled":0},"max_trackers_reached":0,"max_frags_reached":0,"tracker_soft_reuse":0,"tracker_hard_reuse":0,"wrk":{"tracker_timeout":0},"mgr":{"tracker_timeout":0},"memuse":33554432},"flow_bypassed":{"local_pkts":0,"local_bytes":0,"local_capture_pkts":0,"local_capture_bytes":0,"closed":0,"pkts":0,"bytes":0},"detect":{"engines":[{"id":0,"last_reload":"2026-08-05T22:12:23.955189+0300","rules_loaded":3,"rules_failed":0,"rules_skipped":0}],"alert":0,"alert_queue_overflow":0,"alerts_suppressed":0,"lua":{"errors":0,"blocked_function_errors":0,"instruction_limit_errors":0,"memory_limit_errors":0}},"app_layer":{"flow":{"failed_tcp":0,"http":0,"ftp":0,"smtp":0,"tls":0,"ssh":0,"imap":0,"smb":0,"dcerpc_tcp":0,"dns_tcp":0,"nfs_tcp":0,"ntp":0,"ftp-data":0,"tftp":0,"ike":0,"krb5_tcp":0,"quic":0,"dhcp":0,"sip_tcp":0,"rfb":0,"mqtt":0,"telnet":0,"websocket":0,"ldap_tcp":4,"doh2":0,"rdp":0,"http2":0,"bittorrent-dht":0,"pop3":0,"mdns":0,"snmp":0,"failed_udp":0,"dcerpc_udp":0,"dns_udp":0,"nfs_udp":0,"krb5_udp":0,"sip_udp":0,"ldap_udp":0},"error":{"failed_tcp":{"gap":0},"http":{"gap":0,"alloc":0,"parser":0,"internal":0},"ftp":{"gap":0,"alloc":0,"parser":0,"internal":0},"smtp":{"gap":0,"alloc":0,"parser":0,"internal":0},"tls":{"gap":0,"alloc":0,"parser":0,"internal":0},"ssh":{"gap":0,"alloc":0,"parser":0,"internal":0},"smb":{"gap":0,"alloc":0,"parser":0,"internal":0},"dcerpc_tcp":{"gap":0,"alloc":0,"parser":0,"internal":0},"dns_tcp":{"gap":0,"alloc":0,"parser":0,"internal":0},"nfs_tcp":{"gap":0,"alloc":0,"parser":0,"internal":0},"ftp-data":{"gap":0,"alloc":0,"parser":0,"internal":0},"krb5_tcp":{"gap":0,"alloc":0,"parser":0,"internal":0},"sip_tcp":{"gap":0,"alloc":0,"parser":0,"internal":0},"rfb":{"gap":0,"alloc":0,"parser":0,"internal":0},"mqtt":{"gap":0,"alloc":0,"parser":0,"internal":0},"telnet":{"gap":0,"alloc":0,"parser":0,"internal":0},"websocket":{"gap":0,"alloc":0,"parser":0,"internal":0},"ldap_tcp":{"gap":0,"alloc":0,"parser":2,"internal":0},"doh2":{"gap":0,"alloc":0,"parser":0,"internal":0},"rdp":{"gap":0,"alloc":0,"parser":0,"internal":0},"http2":{"gap":0,"alloc":0,"parser":0,"internal":0},"pop3":{"gap":0,"alloc":0,"parser":0,"internal":0},"dcerpc_udp":{"alloc":0,"parser":0,"internal":0},"dns_udp":{"alloc":0,"parser":0,"internal":0},"nfs_udp":{"alloc":0,"parser":0,"internal":0},"ntp":{"alloc":0,"parser":0,"internal":0},"tftp":{"alloc":0,"parser":0,"internal":0},"ike":{"alloc":0,"parser":0,"internal":0},"krb5_udp":{"alloc":0,"parser":0,"internal":0},"quic":{"alloc":0,"parser":0,"internal":0},"dhcp":{"alloc":0,"parser":0,"internal":0},"sip_udp":{"alloc":0,"parser":0,"internal":0},"ldap_udp":{"alloc":0,"parser":0,"internal":0},"bittorrent-dht":{"alloc":0,"parser":0,"internal":0},"mdns":{"alloc":0,"parser":0,"internal":0},"snmp":{"alloc":0,"parser":0,"internal":0}},"tx":{"http":0,"ftp":0,"smtp":0,"tls":0,"ssh":0,"smb":0,"dcerpc_tcp":0,"dns_tcp":0,"nfs_tcp":0,"ftp-data":0,"krb5_tcp":0,"sip_tcp":0,"rfb":0,"mqtt":0,"telnet":0,"websocket":0,"ldap_tcp":8,"doh2":0,"rdp":0,"http2":0,"pop3":0,"dcerpc_udp":0,"dns_udp":0,"nfs_udp":0,"ntp":0,"tftp":0,"ike":0,"krb5_udp":0,"quic":0,"dhcp":0,"sip_udp":0,"ldap_udp":0,"bittorrent-dht":0,"mdns":0,"snmp":0},"expectations":0},"memcap":{"pressure":5,"pressure_max":5},"http":{"memuse":0,"memcap":0,"byterange":{"memuse":168384,"memcap":104857600}},"ftp":{"memuse":0,"memcap":0},"ippair":{"memuse":398144,"memcap":16777216},"host":{"memuse":382144,"memcap":33554432},"file_store":{"open_files":0}}}

« Previous
1
2
3
…
5
Next »

(1-1/5)

Project

General

Profile

Suricata

Bug #8811 » eve.json