Suricata: flow_id is not the signature id

The flow id groups one connection’s records

Suricata can stamp a flow_id on the records it links to one flow. That number is how you find the other records of that flow in the same file. It is not a rule, and it is not a case number from a ticket system.

A second flow_id is a second flow. Do not add its alerts to the first because the addresses look familiar.

The signature id is the rule

On an alert record, signature_id names the rule that matched. Two alert records with the same flow_id and different signature ids are two matches on that flow. Quoting only the flow id leaves the rule unnamed.

If an alert has no signature_id in the paste, write “signature id not in the paste.” Do not copy the flow id into that blank.

What to file

File flow_id when you are tying records together, and signature_id when you are naming a rule. A sentence that says “the detection” needs the signature id. A sentence that says “the same flow” needs the flow id.

Worked case: one flow, two rules

In a lab eve.json, flow 4412 has two alert records. One shows signature_id 1001. The other shows signature_id 1002. A draft says a single rule fired twice because the flow id is the same.

The note quotes flow 4412 once and the two signature ids separately. They are two matches on one flow. The draft’s single rule is replaced by the two ids.

flow_id: 4412
alert A signature_id: 1001
alert B signature_id: 1002
write: one flow, two rules
not: one rule because the flow id matches