Zeek DNS JSON

Zeek DNS JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 5

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 9352fefb1d76b62f720bd7b892c0be00f4d90b6003f91dfdfbff6f0780d2202c

{
  "ts": 1774911641.803041,
  "uid": "CHhAvVGS1DHFjwGM9",
  "id.orig_h": "172.17.0.2",
  "id.orig_p": 36844,
  "id.resp_h": "1.1.1.1",
  "id.resp_p": 53,
  "proto": "udp",
  "trans_id": 20661,
  "rtt": 0.03837108612060547,
  "query": "zeek.org",
  "qclass": 1,
  "qclass_name": "C_INTERNET",
  "qtype": 1,
  "qtype_name": "A",
  "rcode": 0,
  "rcode_name": "NOERROR",
  "AA": false,
  "TC": false,
  "RD": true,
  "RA": true,
  "Z": 2,
  "answers": [
    "192.0.78.150",
    "192.0.78.212"
  ],
  "TTLs": [
    60.0,
    60.0
  ],
  "rejected": false,
  "opcode": 0,
  "opcode_name": "query"
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`ts`	float
`uid`	str
`id.orig_h`	str
`id.orig_p`	int
`id.resp_h`	str
`id.resp_p`	int
`proto`	str
`trans_id`	int
`rtt`	float
`query`	str
`qclass`	int
`qclass_name`	str
`qtype`	int
`qtype_name`	str
`rcode`	int
`rcode_name`	str
`AA`	bool
`TC`	bool
`RD`	bool
`RA`	bool
`Z`	int
`answers`	array
`answers[0]`	str
`TTLs`	array
`TTLs[0]`	float
`rejected`	bool
`opcode`	int
`opcode_name`	str

ts: Epoch timestamp of the logged activity.
uid: Connection identifier, when present; retain sensor context.
fuid: File identifier, when present.
id.orig_h / id.resp_h: Originator and responder addresses, not necessarily client intent.

Investigation uses

Review queried names, response codes and answers.
Join uid across connection and protocol logs; use fuid for file references when present.

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

DC0096 — conceptual telemetry association, not coverage proof

References

dns.log — Book of Zeek (9.0.1)

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.