Zeek connection JSON

Zeek connection JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 5

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 2a1bf18ec5642a983f337626f13e9186b895dbe36dd1374c84930ba9d0f4b6f1

{
  "ts": 1591367999.430166,
  "uid": "C5bLoe2Mvxqhawzqqd",
  "id.orig_h": "192.168.4.76",
  "id.orig_p": 46378,
  "id.resp_h": "31.3.245.133",
  "id.resp_p": 80,
  "proto": "tcp",
  "service": "http",
  "duration": 0.25411510467529297,
  "orig_bytes": 77,
  "resp_bytes": 295,
  "conn_state": "SF",
  "missed_bytes": 0,
  "history": "ShADadFf",
  "orig_pkts": 6,
  "orig_ip_bytes": 397,
  "resp_pkts": 4,
  "resp_ip_bytes": 511,
  "ip_proto": 6
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`ts`	float
`uid`	str
`id.orig_h`	str
`id.orig_p`	int
`id.resp_h`	str
`id.resp_p`	int
`proto`	str
`service`	str
`duration`	float
`orig_bytes`	int
`resp_bytes`	int
`conn_state`	str
`missed_bytes`	int
`history`	str
`orig_pkts`	int
`orig_ip_bytes`	int
`resp_pkts`	int
`resp_ip_bytes`	int
`ip_proto`	int

ts: Epoch timestamp of the logged activity.
uid: Connection identifier, when present; retain sensor context.
fuid: File identifier, when present.
id.orig_h / id.resp_h: Originator and responder addresses, not necessarily client intent.

Investigation uses

Correlate connection state, duration and byte counts.
Join uid across connection and protocol logs; use fuid for file references when present.

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

DC0082 — conceptual telemetry association, not coverage proof

References

conn.log — Book of Zeek (9.0.1)

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.