alert

suricata.alert

customer_id

string

The code of the account that owns the event.

dest_ip

string

The IP of the responder to the connection.

dest_port

integer

The port of the responder to the connection.

dst_ip_enrichments

ip_enrichments

Enrichments for an IP.

event_type

string

The type of event recorded.

geo_distance

number

The difference between src and dst geo values.

http

suricata.http

intel

intel[ ]

Intel that matched entities in the event.

payload

string

The raw payload from the traffic that matched the signature.

proto

string

The transport layer protocol used.

sensor_id

string

The sensor that created the event.

source

string

The source of the event.

src_ip

string

The IP of the initiator of the connection.

src_ip_enrichments

ip_enrichments

Enrichments for an IP.

src_port

integer

The port of the initiator of the connection.

timestamp

string

The time at which traffic for the event began.

category

string

The signature's category.

rev

integer

The signature's revision number.

severity

integer

The signature's severity rating (1 = high, 3 = low).

signature

string

The signature's name.

hostname

string

The content Host header.

hostname_enrichments

ip_ enrichments or domain_enrichments

Enrichments for an IP or domain.

http_content_type

string

The fingerprinted MIME-type of the response content, use instead of response_mime.

http_method

string

The HTTP method selected.

http_refer

string

The content of the Referrer header.

http_user_agent

string

The content of the UserAgentheader.

length

integer

The length in bytes of the response.

protocol

string

The protocol version.

redirect

string

The target location of the redirect.

status

integer

The numeric code of the server's response.

url

string

The full URI of the request.