Zeek SMTP JSON

Zeek SMTP JSON. Zeek protocol analysis produces structured metadata from observed network traffic.

Source and collection

Corresponding Zeek log stream with JSON output enabled; default TSV is a different serialization.

Document sensor placement, packet loss, enabled analyzers and JSON logging configuration.

Native example and provenance

publisher documentation example. Published example; no independent capture provenance claimed.

Original publisher / pinned upstream fixture — preformatted example 2

One complete record selected; values unchanged.

Download the exact sample · Offline research kit

SHA-256: d0e780ed7c89cbc8c910fee3c7dcbddf2b4b836d0013f0a84324afd9de3f4903

{
  "ts": 1254722768.219663,
  "uid": "C1qe8w3QHRF2N5tVV5",
  "id.orig_h": "10.10.1.4",
  "id.orig_p": 1470,
  "id.resp_h": "74.53.140.153",
  "id.resp_p": 25,
  "trans_depth": 1,
  "helo": "GP",
  "mailfrom": "gurpartap@patriots.in",
  "rcptto": [
    "raj_deol2002in@yahoo.co.in"
  ],
  "date": "Mon, 5 Oct 2009 11:36:07 +0530",
  "from": "\"Gurpartap Singh\" <gurpartap@patriots.in>",
  "to": [
    "<raj_deol2002in@yahoo.co.in>"
  ],
  "msg_id": "<000301ca4581$ef9e57f0$cedb07d0$@in>",
  "subject": "SMTP",
  "last_reply": "250 OK id=1Mugho-0003Dg-Un",
  "path": [
    "74.53.140.153",
    "10.10.1.4"
  ],
  "user_agent": "Microsoft Office Outlook 12.0",
  "tls": false,
  "fuids": [
    "Fel9gs4OtNEV6gUJZ5",
    "Ft4M3f2yMvLlmwtbq9",
    "FL9Y0d45OI4LpS6fmh"
  ]
}

Structure and field interpretation

Observed structure in this specific sample
Field/path	Serialized type
`ts`	float
`uid`	str
`id.orig_h`	str
`id.orig_p`	int
`id.resp_h`	str
`id.resp_p`	int
`trans_depth`	int
`helo`	str
`mailfrom`	str
`rcptto`	array
`rcptto[0]`	str
`date`	str
`from`	str
`to`	array
`to[0]`	str
`msg_id`	str
`subject`	str
`last_reply`	str
`path`	array
`path[0]`	str
`user_agent`	str
`tls`	bool
`fuids`	array
`fuids[0]`	str

ts: Epoch timestamp of the logged activity.
uid: Connection identifier, when present; retain sensor context.
fuid: File identifier, when present.
id.orig_h / id.resp_h: Originator and responder addresses, not necessarily client intent.

Investigation uses

Review mail transaction metadata and related extracted files.
Join uid across connection and protocol logs; use fuid for file references when present.

Validation boundaries

Encrypted payloads and sensor visibility limit what can be observed. Missing fields are not equivalent to a negative finding.

This sample passed byte-integrity and JSON/XML parsing checks, including the catalogue’s specified event discriminators. This is not a complete vendor-schema validation or a tested detection.

For a simulation, first parse this fixture offline, then create a separately labelled synthetic variant and test it against the intended collector in an isolated lab. Never replay public example identities or destinations into production.

Ecosystem connections

References

smtp.log — Book of Zeek (9.0.1)

Sample provenance is linked above. Field availability and product behavior must be checked against the deployed version.