Zeek file analysis JSON

Zeek file analysis JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 7

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 2147c5e00848cf7c329729eec3462f0065fc40758f4bb3d52614a7c4ecdbe22a

{
  "ts": 1596820191.969902,
  "fuid": "FBbQxG1GXLXgmWhbk9",
  "uid": "CzoFRWTQ6YIzfFXHk",
  "id.orig_h": "192.168.4.37",
  "id.orig_p": 58264,
  "id.resp_h": "23.195.64.241",
  "id.resp_p": 80,
  "source": "HTTP",
  "depth": 0,
  "analyzers": [
    "EXTRACT",
    "PE"
  ],
  "mime_type": "application/x-dosexec",
  "duration": 0.015498876571655273,
  "is_orig": false,
  "seen_bytes": 179272,
  "total_bytes": 179272,
  "missing_bytes": 0,
  "overflow_bytes": 0,
  "timedout": false,
  "extracted": "HTTP-FBbQxG1GXLXgmWhbk9.exe",
  "extracted_cutoff": false
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`ts`	float
`fuid`	str
`uid`	str
`id.orig_h`	str
`id.orig_p`	int
`id.resp_h`	str
`id.resp_p`	int
`source`	str
`depth`	int
`analyzers`	array
`analyzers[0]`	str
`mime_type`	str
`duration`	float
`is_orig`	bool
`seen_bytes`	int
`total_bytes`	int
`missing_bytes`	int
`overflow_bytes`	int
`timedout`	bool
`extracted`	str
`extracted_cutoff`	bool

ts: Epoch timestamp of the logged activity.
uid: Connection identifier, when present; retain sensor context.
fuid: File identifier, when present.
id.orig_h / id.resp_h: Originator and responder addresses, not necessarily client intent.

Investigation uses

Join file IDs to protocol and connection evidence.
Join uid across connection and protocol logs; use fuid for file references when present.

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

files.log — Book of Zeek (9.0.1)

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.