Suricata Logs Connecting Suricata logs to your Panther Console
Overview
Panther supports ingesting Suricata logs via common Data Transport options: Amazon Web Services (AWS) S3, SQS, and CloudWatch.
How to onboard Suricata logs to Panther
To connect these logs into Panther:
In the left-hand navigation bar of your Panther Console, click Configure > Log Sources .
Search for the log type you want to onboard, then click its tile.
Select the data transport method you wish to use for this integration, then follow Panther's instructions for configuring the method:
Configure Suricata to push logs to the Data Transport source.
See Suricata's documentation for instructions on pushing logs to your selected Data Transport source.
Supported log types
Suricata.Alert
Suricata parser for the Alert event type in the EVE JSON output.
For more information, see the Suricata documentation on
Reference: Suricata.Alert
Copy parser :
native :
name : Suricata.Alert
fields :
- name : files
description : files
type : array
element :
type : object
fields :
- name : filename
required : true
description : filename
type : string
- name : gaps
required : true
description : gaps
type : boolean
- name : size
required : true
description : size
type : bigint
- name : state
required : true
description : state
type : string
- name : stored
required : true
description : stored
type : boolean
- name : tx_id
required : true
description : tx_id
type : bigint
- name : tx_id
description : tx_id
type : bigint
- name : http
description : http
type : object
fields :
- name : http_content_type
description : http_content_type
type : string
- name : hostname
description : hostname
type : string
- name : http_method
description : http_method
type : string
- name : http_user_agent
description : http_user_agent
type : string
- name : length
description : length
type : bigint
- name : protocol
description : protocol
type : string
- name : status
description : status
type : bigint
- name : url
description : url
type : string
- name : ssh
description : ssh
type : object
fields :
- name : server
description : server
type : object
fields :
- name : proto_version
required : true
description : proto_version
type : float
- name : software_version
required : true
description : software_version
type : string
- name : app_proto_tc
description : app_proto_tc
type : string
- name : tls
description : tls
type : object
fields :
- name : sni
description : sni
type : string
indicators :
- ip
- name : ja3
required : true
description : ja3
type : object
fields :
- name : hash
required : true
description : hash
type : string
- name : string
required : true
description : string
type : string
- name : version
required : true
description : version
type : string
- name : app_proto
description : app_proto
type : string
- name : metadata
description : metadata
type : object
fields :
- name : flowbits
description : flowbits
type : array
element :
type : string
- name : flowints
description : flowints
type : object
fields :
- name : applayer.anomaly.count
description : applayer.anomaly.count
type : bigint
- name : alert
required : true
description : alert
type : object
fields :
- name : metadata
description : metadata
type : object
fields :
- name : former_category
description : former_category
type : array
element :
type : string
- name : affected_product
description : affected_product
type : array
element :
type : string
- name : attack_target
description : attack_target
type : array
element :
type : string
- name : deployment
description : deployment
type : array
element :
type : string
- name : signature_severity
description : signature_severity
type : array
element :
type : string
- name : tag
description : tag
type : array
element :
type : string
- name : created_at
required : true
description : created_at
type : array
element :
type : float
- name : updated_at
required : true
description : updated_at
type : array
element :
type : float
- name : action
required : true
description : action
type : string
- name : category
required : true
description : category
type : string
- name : gid
required : true
description : gid
type : bigint
- name : rev
required : true
description : rev
type : bigint
- name : severity
required : true
description : severity
type : bigint
- name : signature
required : true
description : signature
type : string
- name : signature_id
required : true
description : signature_id
type : bigint
- name : dest_ip
required : true
description : dest_ip
type : string
indicators :
- ip
- name : dest_port
required : true
description : dest_port
type : bigint
- name : event_type
required : true
description : event_type
type : string
- name : flow
required : true
description : flow
type : object
fields :
- name : bytes_toclient
required : true
description : bytes_toclient
type : bigint
- name : bytes_toserver
required : true
description : bytes_toserver
type : bigint
- name : pkts_toclient
required : true
description : pkts_toclient
type : bigint
- name : pkts_toserver
required : true
description : pkts_toserver
type : bigint
- name : start
required : true
description : start
type : string
- name : flow_id
required : true
description : flow_id
type : bigint
- name : in_iface
required : true
description : in_iface
type : string
- name : proto
required : true
description : proto
type : string
- name : src_ip
required : true
description : src_ip
type : string
indicators :
- ip
- name : src_port
required : true
description : src_port
type : bigint
- name : timestamp
required : true
description : Suricata DNS Timestamp
type : timestamp
timeFormat : strftime=%Y-%m-%dT%H:%M:%S.%f%z
isEventTime : true
Suricata.Anomaly
Suricata parser for the Anomaly event type in the EVE JSON output.
Reference: Suricata Documentation on EVE JSON Output Anomalies.
{ "code":bigint, "event":string, "layer":string, "type":string }
Suricata Anomaly AppProto
Suricata Anomaly CommunityID
Suricata Anomaly DestPort
Suricata Anomaly EventType
Suricata Anomaly IcmpCode
Suricata Anomaly IcmpType
{ "flowbits":[string], "flowints":{ "applayer_anomaly_count":bigint, "http_anomaly_count":bigint, "tcp_retransmission_count":bigint, "tls_anomaly_count":bigint } }
Suricata Anomaly Metadata
Suricata Anomaly PacketInfo
Suricata Anomaly PcapFilename
Suricata Anomaly Timestamp
Panther added field with type of log
Panther added field with unique id (within table)
Panther added standardize event time (UTC)
Panther added standardize log parse time (UTC)
Panther added field with the source id
Panther added field with the source label
Panther added field with collection of ip addresses associated with the row
Panther added field with collection of domain names associated with the row
Panther added field with collection of SHA1 hashes associated with the row
Panther added field with collection of MD5 hashes associated with the row
Panther added field with collection of SHA256 hashes of any algorithm associated with the row
Suricata.DHCP
Suricata parser for the DHCP event type in the EVE JSON output.
Reference: Suricata.DHCP
Copy parser :
native :
name : Suricata.DHCP
description : Suricata parser for the DHCP event type in the EVE JSON output.
referenceURL : https://suricata.readthedocs.io/en/suricata-5.0.2/output/eve/eve-json-output.html
fields :
- name : dest_ip
required : true
description : dest_ip
type : string
indicators :
- ip
- name : dest_port
required : true
description : dest_port
type : bigint
- name : dhcp
required : true
description : dhcp
type : object
fields :
- name : assigned_ip
required : true
description : assigned_ip
type : string
indicators :
- ip
- name : client_mac
required : true
description : client_mac
type : string
- name : dhcp_type
required : true
description : dhcp_type
type : string
- name : hostname
required : true
description : hostname
type : string
- name : id
required : true
description : id
type : string
indicators :
- trace_id
- name : type
required : true
description : type
type : string
- name : event_type
required : true
description : event_type
type : string
- name : flow_id
required : true
description : flow_id
type : bigint
- name : in_iface
required : true
description : in_iface
type : string
- name : proto
required : true
description : proto
type : string
- name : src_ip
required : true
description : src_ip
type : string
indicators :
- ip
- name : src_port
required : true
description : src_port
type : bigint
- name : timestamp
required : true
description : Suricata DNS Timestamp
type : timestamp
timeFormat : strftime=%Y-%m-%dT%H:%M:%S.%f%z
isEventTime : true
Suricata.DNS
Suricata parser for the DNS event type in the EVE JSON output.
Reference: Suricata Documentation on EVE JSON Output DNS.
Copy schema : Suricata.DNS
description : Suricata parser for the DNS event type in the EVE JSON output.
referenceURL : https://suricata.readthedocs.io/en/suricata-5.0.2/output/eve/eve-json-output.html#dns
fields :
- name : community_id
description : Suricata DNS CommunityID
type : string
- name : dns
required : true
description : Suricata DNS DNS
type : object
fields :
- name : aa
description : Suricata DNSDetails Aa
type : boolean
- name : answers
description : Suricata DNSDetails Answers
type : array
element :
type : object
fields :
- name : rdata
required : true
description : Suricata DNSDetailsAnswers Rdata
type : string
indicators :
- hostname
- name : rrname
required : true
description : Suricata DNSDetailsAnswers Rrname
type : string
indicators :
- domain
- name : rrtype
required : true
description : Suricata DNSDetailsAnswers Rrtype
type : string
- name : ttl
required : true
description : Suricata DNSDetailsAnswers TTL
type : bigint
- name : authorities
description : Suricata DNSDetails Authorities
type : array
element :
type : object
fields :
- name : rrname
required : true
description : Suricata DNSDetailsAuthorities Rrname
type : string
- name : rrtype
required : true
description : Suricata DNSDetailsAuthorities Rrtype
type : string
- name : soa
required : true
type : object
fields :
- name : expire
required : true
type : bigint
- name : minimum
required : true
type : bigint
- name : mname
required : true
type : string
- name : refresh
required : true
type : bigint
- name : retry
required : true
type : bigint
- name : rname
required : true
type : string
- name : serial
required : true
type : bigint
- name : ttl
required : true
description : Suricata DNSDetailsAuthorities TTL
type : bigint
- name : flags
description : Suricata DNSDetails Flags
type : string
- name : grouped
description : Suricata DNSDetails Grouped
type : object
fields :
- name : A
description : Suricata DNSDetailsGrouped A
type : array
element :
type : string
indicators :
- ip
- name : AAAA
description : Suricata DNSDetailsGrouped Aaaa
type : array
element :
type : string
indicators :
- ip
- name : CNAME
description : Suricata DNSDetailsGrouped Cname
type : array
element :
type : string
indicators :
- domain
- name : MX
description : Suricata DNSDetailsGrouped Mx
type : array
element :
type : string
indicators :
- domain
- name : PTR
description : Suricata DNSDetailsGrouped Ptr
type : array
element :
type : string
- name : TXT
description : Suricata DNSDetailsGrouped Txt
type : array
element :
type : string
- name : id
required : true
description : Suricata DNSDetails ID
type : bigint
- name : qr
description : Suricata DNSDetails Qr
type : boolean
- name : ra
description : Suricata DNSDetails Ra
type : boolean
- name : rcode
description : Suricata DNSDetails Rcode
type : string
- name : rd
description : Suricata DNSDetails Rd
type : boolean
- name : rrname
description : Suricata DNSDetails Rrname
type : string
indicators :
- domain
- name : rdata
description : Suricata DNSDetails RData
type : string
indicators :
- ip
- name : rrtype
description : Suricata DNSDetails Rrtype
type : string
- name : ttl
description : Suricata DNSDetails TTL
type : bigint
- name : tx_id
description : Suricata DNSDetails TxID
type : bigint
- name : type
description : Suricata DNSDetails Type
type : string
- name : version
description : Suricata DNSDetails Version
type : bigint
- name : dest_ip
required : true
description : Suricata DNS DestIP
type : string
indicators :
- ip
- name : dest_port
description : Suricata DNS DestPort
type : int
- name : event_type
required : true
description : Suricata DNS EventType
type : string
- name : flow_id
required : true
description : Suricata DNS FlowID
type : bigint
indicators :
- trace_id
- name : pcap_cnt
description : Suricata DNS PcapCnt
type : bigint
- name : pcap_filename
description : Suricata DNS PcapFilename
type : string
- name : proto
required : true
description : Suricata DNS Proto
type : string
- name : in_iface
type : string
- name : src_ip
required : true
description : Suricata DNS SrcIP
type : string
indicators :
- ip
- name : src_port
description : Suricata DNS SrcPort
type : int
- name : timestamp
required : true
description : Suricata DNS Timestamp
type : timestamp
timeFormats :
- '%Y-%m-%dT%H:%M:%S.%f%z'
isEventTime : true
- name : vlan
description : Suricata DNS Vlan
type : array
element :
type : bigint
Suricata.FileInfo
Suricata parser for the FileInfo event type in the EVE JSON output.
Reference: File and store EVE file info .
Copy schema : Suricata.FileInfo
parser :
native :
name : Suricata.FileInfo
description : Suricata parser for the FileInfo event type in the EVE JSON output.
referenceURL: https://suricata.readthedocs.io/en/suricata-6.0.0/file-extraction/file-extraction.html#file-store-and-eve-fileinfo
fields :
- name : app_proto
required : true
description : app_proto
type : string
- name : dest_ip
required : true
description : dest_ip
type : string
indicators :
- ip
- name : dest_port
required : true
description : dest_port
type : bigint
- name : event_type
required : true
description : event_type
type : string
- name : fileinfo
required : true
description : fileinfo
type : object
fields :
- name : filename
required : true
description : filename
type : string
- name : gaps
required : true
description : gaps