Zeek HTTP JSON

Zeek HTTP JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 2

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: 2f6c37dfdd8880426ed9927e5ac3fc1dc845a57b134ca814878c977eb56f0bac

{"ts":1591367999.512593,"uid":"C5bLoe2Mvxqhawzqqd","id.orig_h":"192.168.4.76","id.orig_p":46378,"id.resp_h":"31.3.245.133","id.resp_p":80,"trans_depth":1,"method":"GET","host":"testmyids.com","uri":"/","version":"1.1","user_agent":"curl/7.47.0","request_body_len":0,"response_body_len":39,"status_code":200,"status_msg":"OK","tags":[],"resp_fuids":["FEEsZS1w0Z0VJIb5x4"],"resp_mime_types":["text/plain"]}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`ts`	float
`uid`	str
`id.orig_h`	str
`id.orig_p`	int
`id.resp_h`	str
`id.resp_p`	int
`trans_depth`	int
`method`	str
`host`	str
`uri`	str
`version`	str
`user_agent`	str
`request_body_len`	int
`response_body_len`	int
`status_code`	int
`status_msg`	str
`tags`	array
`resp_fuids`	array
`resp_fuids[0]`	str
`resp_mime_types`	array
`resp_mime_types[0]`	str

ts: Epoch timestamp of the logged activity.
uid: Connection identifier, when present; retain sensor context.
fuid: File identifier, when present.
id.orig_h / id.resp_h: Originator and responder addresses, not necessarily client intent.

Investigation uses

Inspect request method, host, URI and response status.
Join uid across connection and protocol logs; use fuid for file references when present.

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

http.log — Book of Zeek (9.0.1)

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.