Suricata eve.json tutorial: reading alerts, flows, and protocol logs with jq

What Suricata produces

Suricata is an open-source network IDS and IPS. Besides alerts, it writes protocol metadata in a single JSON-lines file, eve.json: event_type values include alert, flow, dns, http, tls, fileinfo, and anomaly. Every event in the same flow shares a flow_id, which lets you connect an alert to the DNS lookup and TLS handshake around it.

Rule anatomy in one line

A rule has an action, protocol, source and destination with ports, and options in parentheses: msg, content matches, flow direction, sid, and rev. The Emerging Threats Open ruleset is a common free starting point, managed with suricata-update.

Snippet

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"LAB curl user agent to external host"; flow:established,to_server; http.user_agent; content:"curl/"; startswith; sid:1000001; rev:1;)

Lab: replay a pcap

Install Suricata on a lab VM, update rules, and run it in offline mode against a training pcap such as one from a public malware-traffic training site, inside an isolated VM. Then summarize the results with jq: top signatures, top talkers for alerts, and the DNS names queried by the alerting host.

Snippet

sudo suricata-update
suricata -r lab.pcap -l ./out -k none
jq -r 'select(.event_type=="alert") | .alert.signature' out/eve.json | sort | uniq -c | sort -rn | head
jq -r 'select(.event_type=="alert") | [.src_ip, .dest_ip, .dest_port, .alert.severity] | @tsv' out/eve.json | sort | uniq -c | sort -rn | head
jq -r 'select(.event_type=="dns" and .src_ip=="10.0.0.5") | .dns.rrname? // .dns.queries[]?.rrname' out/eve.json | sort -u
FID=$(jq -r 'select(.event_type=="alert") | .flow_id' out/eve.json | head -1); jq -c "select(.flow_id==$FID)" out/eve.json

Triage habits

Treat signature names as a starting hypothesis. Look at the surrounding protocol events for the same flow and host, check whether the destination is internal or external, and decide whether the traffic is a true attack, a policy violation, or a false positive from a broad rule. Tune noisy rules with threshold or suppress entries rather than disabling whole categories.

Diagram

eve.json event types

One file, many views of the same traffic.

alert
A rule matched; includes signature, sid, and severity.
flow
Summary of a connection: bytes, packets, duration.
dns / http / tls
Protocol metadata such as names, URLs, SNI, and certificates.
fileinfo
Files seen in traffic, with hashes when enabled.
anomaly
Protocol violations and decoder problems.

Check yourself

1. Which field links an alert to the DNS, HTTP, or TLS events of the same connection?

2. Which rule option uniquely identifies a Suricata signature?

3. How do you run Suricata against a saved capture file?