Suricata EVE flow

Suricata EVE flow. EVE JSON emits typed records from the Suricata network engine.

Source and collection

Configured eve-log output, commonly eve.json.

Record Suricata version, enabled EVE types, ruleset and IDS versus inline IPS mode.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 8

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 199a75828515b96ba46ab0047e820a88071e813d96cc029e56e2cca7f82fdc5c

{
  "timestamp": "2023-09-18T06:13:21.216460+0000",
  "flow_id": 1676750115612680,
  "event_type": "flow",
  "src_ip": "192.168.100.237",
  "src_port": 49175,
  "dest_ip": "142.11.240.191",
  "dest_port": 35361,
  "proto": "TCP",
  "app_proto": "http",
  "flow": {
    "pkts_toserver": 3869,
    "pkts_toclient": 1523,
    "bytes_toserver": 3536402,
    "bytes_toclient": 94102,
    "start": "2023-09-18T06:13:33.324862+0000",
    "end": "2023-09-18T06:14:13.752399+0000",
    "age": 40,
    "state": "closed",
    "reason": "shutdown",
    "alerted": true,
    "exception_policy": [
      {
        "target": "stream_midstream",
        "policy": "ignore"
      }
    ]
  },
  "ether": {
    "dest_macs": [
      "52:54:00:36:3e:ff"
    ],
    "src_macs": [
      "12:a9:86:6c:77:de"
    ]
  },
  "tcp": {
    "tcp_flags": "1e",
    "tcp_flags_ts": "1e",
    "tcp_flags_tc": "1a",
    "syn": true,
    "rst": true,
    "psh": true,
    "ack": true,
    "state": "closed",
    "ts_max_regions": 1,
    "tc_max_regions": 1
  }
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`timestamp`	str
`flow_id`	int
`event_type`	str
`src_ip`	str
`src_port`	int
`dest_ip`	str
`dest_port`	int
`proto`	str
`app_proto`	str
`flow.pkts_toserver`	int
`flow.pkts_toclient`	int
`flow.bytes_toserver`	int
`flow.bytes_toclient`	int
`flow.start`	str
`flow.end`	str
`flow.age`	int
`flow.state`	str
`flow.reason`	str
`flow.alerted`	bool
`flow.exception_policy`	array
`flow.exception_policy[0].target`	str
`flow.exception_policy[0].policy`	str
`ether.dest_macs`	array
`ether.dest_macs[0]`	str
`ether.src_macs`	array
`ether.src_macs[0]`	str
`tcp.tcp_flags`	str
`tcp.tcp_flags_ts`	str
`tcp.tcp_flags_tc`	str
`tcp.syn`	bool
`tcp.rst`	bool
`tcp.psh`	bool
`tcp.ack`	bool
`tcp.state`	str
`tcp.ts_max_regions`	int
`tcp.tc_max_regions`	int

event_type: Selects the payload schema.
flow_id: Flow correlation identifier; preserve numeric precision.
timestamp: Event time with offset.
alert: Rule-match context when present.

Investigation uses

Correlate flow_id and event_type with related protocol and alert records.
For alerts, review signature, action and packet context before assigning a verdict.

Validation boundaries

An alert is a rule match, not independently confirmed compromise. Fields and nested structures differ by event type and version.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

15.1.2. Eve JSON Format — Suricata 9.0.0-dev documentation

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.