Tools · Network IDS and detection as code · 09 / 24
Suricata: a dns or flow row is not an alert
In eve.json, event_type names the kind of row. A dns or flow row is a protocol record. Write that type before any other field, and do not file it as a signature match.
The type comes first
eve.json mixes records in one file. event_type is the field that says which kind you are holding. dns, http, tls, flow, and stats are records of what the sensor parsed. They are not signature matches. A signature match is a different type, and it carries an alert object. If that object is absent, you do not have a signature id to quote.
A hostname inside a dns row is a name the sensor logged for that lookup. It is not a detection title. The row can be useful context later. It is not, by itself, a finding.
What to file when the row is not an alert
Write event_type, the timestamp, the source and destination, and the protocol field you are actually using, such as the queried name on a dns row. Write “not a signature match” in the same note. If you later attach an alert, cite that row separately, with its signature id.
Do not copy a queried name into a sentence that says a rule fired. The rule id is not on this row.
A flow row is a connection summary
A flow row summarizes bytes and packets for a connection the sensor tracked. It can tell you that two addresses exchanged traffic. It does not name a signature, and it does not say the traffic was unwanted. Quote the byte counts as counts. Do not promote them into an incident category.
Worked case: a lookup filed as a detection
A lab eve.json line has event_type dns, a query name status.hackblue-lab.org, and no alert object. A draft ticket says a signature fired on that name because the name also appears in a rule the team owns. The draft never quotes a signature id from this line, because there is not one.
The note quotes event_type dns, the query name, the two addresses, and “not a signature match.” The team’s rule is a different record. If an alert row for that rule exists, it gets its own citation. This dns row stays a lookup the sensor logged.
event_type: dns query name: status.hackblue-lab.org src: 10.8.0.40 dest: 10.8.0.53 alert object: absent write: protocol record, not a signature match
Diagram
event_type before the story
The type decides what the other fields are allowed to mean.
- dns
A lookup the sensor logged. The name is not a signature id.
- flow
Byte and packet counts for a connection. Not a verdict.
- alert
A signature match, and only this type carries the signature id.
- The note
Name the type in the first line, or the rest of the sentence drifts.
Check yourself
1. A row’s event_type is dns and it has no alert object. What is it?
2. Why is a queried name not enough to say a rule fired?
3. What does a flow row support?