Suricata: the host field is who wrote the event

Host is the writer

A row can include a host value: the sensor, or the machine that ran a replay and produced the file. That name is who wrote the JSON. It is not src_ip and it is not dest_ip. Those addresses are the ends of the traffic the record describes.

If the host field is absent, write “host not on this row.” Do not fill it with src_ip because that field is nearby.

A lab replay stamps the lab machine

Replaying a capture on a laptop often sets host to that laptop. The packets can still be between two lab addresses that are not the laptop. Saying the laptop was the source of the traffic confuses the writer with an endpoint in the capture.

A live sensor’s hostname is the sensor that observed the traffic. It is still not the client address, unless you have a separate note that says the sensor is that client, and you cite that note.

What to file

File host, src_ip, and dest_ip with their field names, plus whether this file came from a replay. If you say “the source,” say which field you mean. Do not use the host value in a sentence about who sent the packet.

Worked case: the laptop named as the client

A replay on host analysis-1 writes a row with src_ip 10.8.0.40 and dest_ip 10.8.0.53. A draft says analysis-1 connected to the resolver, because host is the only name in the note. The addresses were never copied.

The note says analysis-1 wrote the file, and 10.8.0.40 is the source address in the traffic. The laptop is not the client in the capture. The draft sentence is removed.

host: analysis-1  (wrote the eve.json row)
src_ip: 10.8.0.40
dest_ip: 10.8.0.53
replay: yes
write: the client address in the traffic is 10.8.0.40
not: analysis-1 connected to the resolver