This documentation contains work-in-progress information for future Elastic Stack and Cloud releases. Use the version selector to view supported release docs. It also contains some Elastic Cloud serverless information. Check out our serverless docs for more details.

› ›

Suricata fields

Module for handling the EVE JSON logs produced by Suricata.

suricata

Fields from the Suricata EVE log file.

eve

Fields exported by the EVE JSON logs

suricata.eve.event_type

type: keyword

suricata.eve.app_proto_orig

type: keyword

suricata.eve.tcp.tcp_flags

type: keyword

suricata.eve.tcp.psh

type: boolean

suricata.eve.tcp.tcp_flags_tc

type: keyword

suricata.eve.tcp.ack

type: boolean

suricata.eve.tcp.syn

type: boolean

suricata.eve.tcp.state

type: keyword

suricata.eve.tcp.tcp_flags_ts

type: keyword

suricata.eve.tcp.rst

type: boolean

suricata.eve.tcp.fin

type: boolean

suricata.eve.fileinfo.sha1

type: keyword

suricata.eve.fileinfo.tx_id

type: long

suricata.eve.fileinfo.state

type: keyword

suricata.eve.fileinfo.stored

type: boolean

suricata.eve.fileinfo.gaps

type: boolean

suricata.eve.fileinfo.sha256

type: keyword

suricata.eve.fileinfo.md5

type: keyword

suricata.eve.icmp_type

type: long

suricata.eve.pcap_cnt

type: long

suricata.eve.dns.type

type: keyword

suricata.eve.dns.rrtype

type: keyword

suricata.eve.dns.rrname

type: keyword

suricata.eve.dns.rdata

type: keyword

suricata.eve.dns.tx_id

type: long

suricata.eve.dns.ttl

type: long

suricata.eve.dns.rcode

type: keyword

suricata.eve.dns.id

type: long

suricata.eve.flow_id

type: keyword

suricata.eve.email.status

type: keyword

suricata.eve.icmp_code

type: long

suricata.eve.http.redirect

type: keyword

suricata.eve.http.protocol

type: keyword

suricata.eve.http.http_content_type

type: keyword

suricata.eve.in_iface

type: keyword

suricata.eve.alert.metadata

Metadata about the alert.

type: flattened

suricata.eve.alert.category

type: keyword

suricata.eve.alert.rev

type: long

suricata.eve.alert.gid

type: long

suricata.eve.alert.signature

type: keyword

suricata.eve.alert.signature_id

type: long

suricata.eve.alert.protocols

type: keyword

suricata.eve.alert.attack_target

type: keyword

suricata.eve.alert.capec_id

type: keyword

suricata.eve.alert.cwe_id

type: keyword

suricata.eve.alert.malware

type: keyword

suricata.eve.alert.cve

type: keyword

suricata.eve.alert.cvss_v2_base

type: keyword

suricata.eve.alert.cvss_v2_temporal

type: keyword

suricata.eve.alert.cvss_v3_base

type: keyword

suricata.eve.alert.cvss_v3_temporal

type: keyword

suricata.eve.alert.priority

type: keyword

suricata.eve.alert.hostile

type: keyword

suricata.eve.alert.infected

type: keyword

suricata.eve.alert.created_at

type: date

suricata.eve.alert.updated_at

type: date

suricata.eve.alert.classtype

type: keyword

suricata.eve.alert.rule_source

type: keyword

suricata.eve.alert.sid

type: keyword

suricata.eve.alert.affected_product

type: keyword

suricata.eve.alert.deployment

type: keyword

suricata.eve.alert.former_category

type: keyword

suricata.eve.alert.mitre_tool_id

type: keyword

suricata.eve.alert.performance_impact

type: keyword

suricata.eve.alert.signature_severity

type: keyword

suricata.eve.alert.tag

type: keyword

suricata.eve.ssh.client.proto_version

type: keyword

suricata.eve.ssh.client.software_version

type: keyword

suricata.eve.ssh.server.proto_version

type: keyword

suricata.eve.ssh.server.software_version

type: keyword

suricata.eve.stats.capture.kernel_packets

type: long

suricata.eve.stats.capture.kernel_drops

type: long

suricata.eve.stats.capture.kernel_ifdrops

type: long

suricata.eve.stats.uptime

type: long

suricata.eve.stats.detect.alert

type: long

suricata.eve.stats.http.memcap

type: long

suricata.eve.stats.http.memuse

type: long

suricata.eve.stats.file_store.open_files

type: long

suricata.eve.stats.defrag.max_frag_hits

type: long

suricata.eve.stats.defrag.ipv4.timeouts

type: long

suricata.eve.stats.defrag.ipv4.fragments

type: long

suricata.eve.stats.defrag.ipv4.reassembled

type: long

suricata.eve.stats.defrag.ipv6.timeouts

type: long

suricata.eve.stats.defrag.ipv6.fragments

type: long

suricata.eve.stats.defrag.ipv6.reassembled

type: long

suricata.eve.stats.flow.tcp_reuse

type: long

suricata.eve.stats.flow.udp

type: long

suricata.eve.stats.flow.memcap

type: long

suricata.eve.stats.flow.emerg_mode_entered

type: long

suricata.eve.stats.flow.emerg_mode_over

type: long

suricata.eve.stats.flow.tcp

type: long

suricata.eve.stats.flow.icmpv6

type: long

suricata.eve.stats.flow.icmpv4

type: long

suricata.eve.stats.flow.spare

type: long

suricata.eve.stats.flow.memuse

type: long

suricata.eve.stats.tcp.pseudo_failed

type: long

suricata.eve.stats.tcp.ssn_memcap_drop

type: long

suricata.eve.stats.tcp.insert_data_overlap_fail

type: long

suricata.eve.stats.tcp.sessions

type: long

suricata.eve.stats.tcp.pseudo

type: long

suricata.eve.stats.tcp.synack

type: long

suricata.eve.stats.tcp.insert_data_normal_fail

type: long

suricata.eve.stats.tcp.syn

type: long

suricata.eve.stats.tcp.memuse

type: long

suricata.eve.stats.tcp.invalid_checksum

type: long

suricata.eve.stats.tcp.segment_memcap_drop

type: long

suricata.eve.stats.tcp.overlap

type: long

suricata.eve.stats.tcp.insert_list_fail

type: long

suricata.eve.stats.tcp.rst

type: long

suricata.eve.stats.tcp.stream_depth_reached

type: long

suricata.eve.stats.tcp.reassembly_memuse

type: long

suricata.eve.stats.tcp.reassembly_gap

type: long

suricata.eve.stats.tcp.overlap_diff_data

type: long

suricata.eve.stats.tcp.no_flow

type: long

suricata.eve.stats.decoder.avg_pkt_size

type: long

suricata.eve.stats.decoder.bytes

type: long

suricata.eve.stats.decoder.tcp

type: long

suricata.eve.stats.decoder.raw

type: long

suricata.eve.stats.decoder.ppp

type: long

suricata.eve.stats.decoder.vlan_qinq

type: long

suricata.eve.stats.decoder.null

type: long

suricata.eve.stats.decoder.ltnull.unsupported_type

type: long

suricata.eve.stats.decoder.ltnull.pkt_too_small

type: long

suricata.eve.stats.decoder.invalid

type: long

suricata.eve.stats.decoder.gre

type: long

suricata.eve.stats.decoder.ipv4

type: long

suricata.eve.stats.decoder.ipv6

type: long

suricata.eve.stats.decoder.pkts

type: long

suricata.eve.stats.decoder.ipv6_in_ipv6

type: long

suricata.eve.stats.decoder.ipraw.invalid_ip_version

type: long

suricata.eve.stats.decoder.pppoe

type: long

suricata.eve.stats.decoder.udp

type: long

suricata.eve.stats.decoder.dce.pkt_too_small

type: long

suricata.eve.stats.decoder.vlan

type: long

suricata.eve.stats.decoder.sctp

type: long

suricata.eve.stats.decoder.max_pkt_size

type: long

suricata.eve.stats.decoder.teredo

type: long

suricata.eve.stats.decoder.mpls

type: long

suricata.eve.stats.decoder.sll

type: long

suricata.eve.stats.decoder.icmpv6

type: long

suricata.eve.stats.decoder.icmpv4

type: long

suricata.eve.stats.decoder.erspan

type: long

suricata.eve.stats.decoder.ethernet

type: long

suricata.eve.stats.decoder.ipv4_in_ipv6

type: long

suricata.eve.stats.decoder.ieee8021ah

type: long

suricata.eve.stats.dns.memcap_global

type: long

suricata.eve.stats.dns.memcap_state

type: long

suricata.eve.stats.dns.memuse

type: long

suricata.eve.stats.flow_mgr.rows_busy

type: long

suricata.eve.stats.flow_mgr.flows_timeout

type: long

suricata.eve.stats.flow_mgr.flows_notimeout

type: long

suricata.eve.stats.flow_mgr.rows_skipped

type: long

suricata.eve.stats.flow_mgr.closed_pruned

type: long

suricata.eve.stats.flow_mgr.new_pruned

type: long

suricata.eve.stats.flow_mgr.flows_removed

type: long

suricata.eve.stats.flow_mgr.bypassed_pruned

type: long

suricata.eve.stats.flow_mgr.est_pruned

type: long

suricata.eve.stats.flow_mgr.flows_timeout_inuse

type: long

suricata.eve.stats.flow_mgr.flows_checked

type: long

suricata.eve.stats.flow_mgr.rows_maxlen

type: long

suricata.eve.stats.flow_mgr.rows_checked

type: long

suricata.eve.stats.flow_mgr.rows_empty

type: long

suricata.eve.stats.app_layer.flow.tls

type: long

suricata.eve.stats.app_layer.flow.ftp

type: long

suricata.eve.stats.app_layer.flow.http

type: long

suricata.eve.stats.app_layer.flow.failed_udp

type: long

suricata.eve.stats.app_layer.flow.dns_udp

type: long

suricata.eve.stats.app_layer.flow.dns_tcp

type: long

suricata.eve.stats.app_layer.flow.smtp

type: long

suricata.eve.stats.app_layer.flow.failed_tcp

type: long

suricata.eve.stats.app_layer.flow.msn

type: long

suricata.eve.stats.app_layer.flow.ssh

type: long

suricata.eve.stats.app_layer.flow.imap

type: long

suricata.eve.stats.app_layer.flow.dcerpc_udp

type: long

suricata.eve.stats.app_layer.flow.dcerpc_tcp

type: long

suricata.eve.stats.app_layer.flow.smb

type: long

suricata.eve.stats.app_layer.tx.tls

type: long

suricata.eve.stats.app_layer.tx.ftp

type: long

suricata.eve.stats.app_layer.tx.http

type: long

suricata.eve.stats.app_layer.tx.dns_udp

type: long

suricata.eve.stats.app_layer.tx.dns_tcp

type: long

suricata.eve.stats.app_layer.tx.smtp

type: long

suricata.eve.stats.app_layer.tx.ssh

type: long

suricata.eve.stats.app_layer.tx.dcerpc_udp

type: long

suricata.eve.stats.app_layer.tx.dcerpc_tcp

type: long

suricata.eve.stats.app_layer.tx.smb

type: long

suricata.eve.tls.notbefore

type: date

suricata.eve.tls.issuerdn

type: keyword

suricata.eve.tls.sni

type: keyword

suricata.eve.tls.version

type: keyword

suricata.eve.tls.session_resumed

type: boolean

suricata.eve.tls.fingerprint

type: keyword

suricata.eve.tls.serial

type: keyword

suricata.eve.tls.notafter

type: date

suricata.eve.tls.subject

type: keyword

suricata.eve.tls.ja3s.string

type: keyword

suricata.eve.tls.ja3s.hash

type: keyword

suricata.eve.tls.ja3.string

type: keyword

suricata.eve.tls.ja3.hash

type: keyword

suricata.eve.app_proto_ts

type: keyword

suricata.eve.flow.age

type: long

suricata.eve.flow.state

type: keyword

suricata.eve.flow.reason

type: keyword

suricata.eve.flow.alerted

type: boolean

suricata.eve.tx_id

type: long

suricata.eve.app_proto_tc

type: keyword

suricata.eve.smtp.rcpt_to

type: keyword

suricata.eve.smtp.mail_from

type: keyword

suricata.eve.smtp.helo

type: keyword

suricata.eve.app_proto_expected

type: keyword

« sophos fields System fields »