types

Documentation

Index

• Constants
• Variables
• type AlertEvent
• type DNSAnswer
• type DNSEvent
• type Entry
• type EveEvent
• type ExtraInfo
• type FlowEvent
  • func (fe *FlowEvent) FromEntry(e *Entry) error
  • func (fe *FlowEvent) Marshal(writer io.Writer) error
  • func (fe *FlowEvent) Unmarshal(reader io.Reader) error
• type HTTPEvent
• type TLSEvent

Constants

const SuricataTimestampFormat = "2006-01-02T15:04:05.999999-0700"

SuricataTimestampFormat is a Go time formatting string describing the timestamp format used by Suricata's EVE JSON output.

Variables

var FlowEventFlags = map[string]uint16{
	"TCP": 1 << 0,
	"UDP": 1 << 1,
}

FlowEventFlags defines various flags for use in FlowEvent.Flags (e.g. the protocol).

Types

type AlertEvent

type AlertEvent struct {
	Action      string `json:"action"`
	Gid         int    `json:"gid"`
	SignatureID int    `json:"signature_id"`
	Rev         int    `json:"rev"`
	Signature   string `json:"signature"`
	Category    string `json:"category"`
	Severity    int    `json:"severity"`
}

AlertEvent is am alert sub-object of an EVE entry.

type DNSAnswer

type DNSAnswer struct {
	DNSRRName string
	DNSRRType string
	DNSRCode  string
	DNSRData  string
	DNSType   string
}

DNSAnswer is a single DNS answer as observed by Suricata

type DNSEvent

type DNSEvent struct {
	Type   string `json:"type"`
	ID     int    `json:"id"`
	Rcode  string `json:"rcode"`
	Rrname string `json:"rrname"`
	Rrtype string `json:"rrtype"`
	TTL    int    `json:"ttl"`
	Rdata  string `json:"rdata"`
	TxID   int    `json:"tx_id"`
}

DNSEvent is a DNS sub-object of an EVE entry.

type Entry

type Entry struct {
	SrcIP         string
	SrcPort       int64
	DestIP        string
	DestPort      int64
	Timestamp     string
	EventType     string
	Proto         string
	HTTPHost      string
	HTTPUrl       string
	HTTPMethod    string
	JSONLine      string
	DNSVersion    int64
	DNSRRName     string
	DNSRRType     string
	DNSRCode      string
	DNSRData      string
	DNSType       string
	DNSAnswers    []DNSAnswer
	TLSSni        string
	BytesToClient int64
	BytesToServer int64
	PktsToClient  int64
	PktsToServer  int64
}

Entry is a collection of data that needs to be parsed FAST from the entry

type EveEvent

type EveEvent struct {
	Timestamp        *suriTime      `json:"timestamp"`
	EventType        string         `json:"event_type"`
	FlowID           int64          `json:"flow_id,omitempty"`
	InIface          string         `json:"in_iface,omitempty"`
	SrcIP            string         `json:"src_ip,omitempty"`
	SrcPort          int            `json:"src_port,omitempty"`
	DestIP           string         `json:"dest_ip,omitempty"`
	DestPort         int            `json:"dest_port,omitempty"`
	Proto            string         `json:"proto,omitempty"`
	AppProto         string         `json:"app_proto,omitempty"`
	TxID             int            `json:"tx_id,omitempty"`
	TCP              *tcpEvent      `json:"tcp,omitempty"`
	PacketInfo       *packetInfo    `json:"packet_info,omitempty"`
	Alert            *AlertEvent    `json:"alert,omitempty"`
	Payload          string         `json:"payload,omitempty"`
	PayloadPrintable string         `json:"payload_printable,omitempty"`
	Stream           int            `json:"stream,omitempty"`
	Packet           string         `json:"packet,omitempty"`
	SMTP             *smtpEvent     `json:"smtp,omitempty"`
	Email            *emailEvent    `json:"email,omitempty"`
	DNS              *DNSEvent      `json:"dns,omitempty"`
	HTTP             *HTTPEvent     `json:"http,omitempty"`
	Fileinfo         *fileinfoEvent `json:"fileinfo,omitempty"`
	Flow             *flowEvent     `json:"flow,omitempty"`
	SSH              *sshEvent      `json:"ssh,omitempty"`
	TLS              *TLSEvent      `json:"tls,omitempty"`
	Stats            *statsEvent    `json:"stats,omitempty"`
	ExtraInfo        *ExtraInfo     `json:"_extra,omitempty"`
}

EveEvent is the huge struct which can contain a parsed suricata eve.json log event.

type ExtraInfo

type ExtraInfo struct {
	BloomIOC string `json:"bloom-ioc,omitempty"`
}

ExtraInfo contains non-EVE-standard extra information

type FlowEvent

type FlowEvent struct {
	Timestamp     uint64
	Format        byte
	SrcIP         []byte
	DestIP        []byte
	SrcPort       uint16
	DestPort      uint16
	BytesToServer uint32
	BytesToClient uint32
	PktsToServer  uint32
	PktsToClient  uint32
	Flags         uint16
}

FlowEvent stores the meta-data of a flow event in a compact, binary form.

func (*FlowEvent) FromEntry

func (fe *FlowEvent) FromEntry(e *Entry) error

FromEntry populates a FlowEvent using an Entry

func (*FlowEvent) Marshal

func (fe *FlowEvent) Marshal(writer io.Writer) error

Marshal writes a FlowEvent to an io.Writer.

func (*FlowEvent) Unmarshal

func (fe *FlowEvent) Unmarshal(reader io.Reader) error

Unmarshal reads a FlowEvent from an io.Reader.

type HTTPEvent

type HTTPEvent struct {
	Hostname        string `json:"hostname"`
	URL             string `json:"url"`
	HTTPUserAgent   string `json:"http_user_agent"`
	HTTPContentType string `json:"http_content_type"`
	HTTPMethod      string `json:"http_method"`
	Protocol        string `json:"protocol"`
	Status          int    `json:"status"`
	Length          int    `json:"length"`
}

HTTPEvent is an HTTP sub-object of an EVE entry.

type TLSEvent

type TLSEvent struct {
	Subject     string `json:"subject"`
	Issuerdn    string `json:"issuerdn"`
	Fingerprint string `json:"fingerprint"`
	Sni         string `json:"sni"`
	Version     string `json:"version"`
}

TLSEvent is a TLS sub-object of an EVE entry.