diff --git a/etc/schema.json b/etc/schema.json index a589376462..53fa65c4ce 100644 --- a/etc/schema.json +++ b/etc/schema.json @@ -6,202 +6,9 @@ "timestamp" ], "properties": { - "app_proto": { - "type": "string" - }, - "app_proto_expected": { - "type": "string" - }, - "app_proto_orig": { - "type": "string" - }, - "app_proto_tc": { - "type": "string" - }, - "app_proto_ts": { - "type": "string" - }, - "capture_file": { - "type": "string" - }, - "community_id": { - "type": "string" - }, - "dest_ip": { - "type": "string" - }, - "dest_port": { - "type": "integer" - }, - "event_type": { - "type": "string" - }, - "flow_id": { - "type": "integer" - }, - "host": { - "$comment": - "May change to sensor_name in the future, or become user configurable: https://redmine.openinfosecfoundation.org/issues/4919", - "description": "the sensor-name, if configured", - "type": "string" - }, - "icmp_code": { - "type": "integer" - }, - "icmp_type": { - "type": "integer" - }, - "in_iface": { - "type": "string" - }, - "ip_v": { - "type": "integer", - "description": "IP version of the packet or flow" - }, - "log_level": { - "type": "string" - }, - "packet": { - "type": "string" - }, - "parent_id": { - "type": "integer" - }, - "payload": { - "type": "string" - }, - "ts_progress": { - "type": "string" - }, - "tc_progress": { - "type": "string" - }, - "payload_length": { - "type": "integer" - }, - "payload_printable": { - "type": "string" - }, - "pcap_cnt": { - "type": "integer" - }, - "pcap_filename": { - "type": "string" - }, - "pkt_src": { - "type": "string" - }, - "proto": { - "type": "string" - }, - "response_icmp_code": { - "type": "integer" - }, - "response_icmp_type": { - "type": "integer" - }, - "spi": { - "type": "integer" - }, - "src_ip": { - "type": "string" - }, - "src_port": { - "type": "integer" - }, - "suricata_version": { - "type": "string" - }, - "stream": { - "type": "integer" - }, - "timestamp": { - "type": "string", - "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+[+\\-]\\d+$" - }, - "verdict": { - "$ref": "#/$defs/verdict_type" - }, - "direction": { - "type": "string" - }, - "tx_id": { - "type": "integer" - }, - "tx_guessed": { - "description": - "the signature that triggered this alert didn't tie to a transaction, so the transaction (and metadata) logged is a forced estimation and may not be the one you expect", - "type": "boolean" - }, - "files": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "additionalProperties": false, - "properties": { - "end": { - "type": "integer" - }, - "filename": { - "type": "string" - }, - "file_id": { - "type": "integer" - }, - "gaps": { - "type": "boolean" - }, - "magic": { - "type": "string" - }, - "md5": { - "type": "string" - }, - "sha1": { - "type": "string" - }, - "sha256": { - "type": "string" - }, - "size": { - "type": "integer" - }, - "start": { - "type": "integer" - }, - "state": { - "type": "string" - }, - "stored": { - "type": "boolean" - }, - "storing": { - "description": "the file is set to be stored when completed", - "type": "boolean" - }, - "tx_id": { - "type": "integer" - }, - "sid": { - "type": "array", - "minItems": 1, - "items": { - "type": "integer" - } - } - } - } - }, - "vlan": { - "type": "array", - "minItems": 1, - "items": { - "type": "number" - } - }, "alert": { "type": "object", + "additionalProperties": false, "properties": { "action": { "type": "string" @@ -212,24 +19,6 @@ "gid": { "type": "integer" }, - "rev": { - "type": "integer" - }, - "rule": { - "type": "string" - }, - "severity": { - "type": "integer" - }, - "signature": { - "type": "string" - }, - "signature_id": { - "type": "integer" - }, - "xff": { - "type": "string" - }, "metadata": { "type": "object", "properties": { @@ -303,8 +92,7 @@ "type": "string" } } - }, - "additionalProperties": true + } }, "references": { "type": "array", @@ -313,8 +101,24 @@ "type": "string" } }, + "rev": { + "type": "integer" + }, + "rule": { + "type": "string" + }, + "severity": { + "type": "integer" + }, + "signature": { + "type": "string" + }, + "signature_id": { + "type": "integer" + }, "source": { "type": "object", + "additionalProperties": false, "properties": { "ip": { "type": "string" @@ -322,11 +126,11 @@ "port": { "type": "integer" } - }, - "additionalProperties": false + } }, "target": { "type": "object", + "additionalProperties": false, "properties": { "ip": { "type": "string" @@ -334,22 +138,23 @@ "port": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "xff": { + "type": "string" } - }, - "additionalProperties": false - }, - "stream_tcp": { - "type": "object", - "additionalProperties": true + } }, "anomaly": { "type": "object", + "additionalProperties": false, "properties": { "app_proto": { "type": "string" }, + "code": { + "type": "integer" + }, "event": { "type": "string" }, @@ -358,59 +163,77 @@ }, "type": { "type": "string" - }, - "code": { - "type": "integer" } - }, - "additionalProperties": false + } }, - "arp": { - "type": "object", - "optional": true, - "properties": { - "hw_type": { - "type": "string", - "description": "Network link protocol type" - }, - "proto_type": { - "type": "string", - "description": "Internetwork protocol for which the ARP request is intended" - }, + "app_proto": { + "type": "string" + }, + "app_proto_expected": { + "type": "string" + }, + "app_proto_orig": { + "type": "string" + }, + "app_proto_tc": { + "type": "string" + }, + "app_proto_ts": { + "type": "string" + }, + "arp": { + "type": "object", + "additionalProperties": false, + "properties": { + "dest_ip": { + "type": "string", + "description": "Logical address of the intended receiver" + }, + "dest_mac": { + "type": "string", + "description": "Physical address of the intended receiver" + }, + "hw_type": { + "type": "string", + "description": "Network link protocol type" + }, "opcode": { "type": "string", "description": "Specifies the operation that the sender is performing" }, - "src_mac": { + "proto_type": { "type": "string", - "description": "Physical address of the sender" + "description": "Internetwork protocol for which the ARP request is intended" }, "src_ip": { "type": "string", "description": "Logical address of the sender" }, - "dest_mac": { - "type": "string", - "description": "Physical address of the intended receiver" - }, - "dest_ip": { + "src_mac": { "type": "string", - "description": "Logical address of the intended receiver" + "description": "Physical address of the sender" } }, - "additionalProperties": false + "optional": true }, "bittorrent_dht": { "type": "object", + "additionalProperties": false, "properties": { - "transaction_id": { - "type": "string" - }, "client_version": { "type": "string" }, - "request_type": { - "type": "string" + "error": { + "type": "object", + "additionalProperties": false, + "properties": { + "msg": { + "type": "string" + }, + "num": { + "type": "integer" + } + } }, "request": { "type": "object", @@ -419,9 +242,6 @@ "id": { "type": "string" }, - "target": { - "type": "string" - }, "implied_port": { "type": "integer" }, @@ -431,11 +251,17 @@ "port": { "type": "integer" }, + "target": { + "type": "string" + }, "token": { "type": "string" } } }, + "request_type": { + "type": "string" + }, "response": { "type": "object", "additionalProperties": false, @@ -506,23 +332,20 @@ } } }, - "error": { - "type": "object", - "additionalProperties": false, - "properties": { - "num": { - "type": "integer" - }, - "msg": { - "type": "string" - } - } + "transaction_id": { + "type": "string" } - }, - "additionalProperties": false + } + }, + "capture_file": { + "type": "string" + }, + "community_id": { + "type": "string" }, "dcerpc": { "type": "object", + "additionalProperties": false, "properties": { "activityuuid": { "type": "string" @@ -530,23 +353,12 @@ "call_id": { "type": "integer" }, - "request": { - "type": "string" - }, - "response": { - "type": "string" - }, - "rpc_version": { - "type": "string" - }, - "seqnum": { - "type": "integer" - }, "interfaces": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "ack_result": { "type": "integer" @@ -567,12 +379,12 @@ ] } } - }, - "additionalProperties": false + } } }, "req": { "type": "object", + "additionalProperties": false, "properties": { "frag_cnt": { "type": "integer" @@ -588,11 +400,14 @@ "stub_data_size": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "request": { + "type": "string" }, "res": { "type": "object", + "additionalProperties": false, "properties": { "frag_cnt": { "type": "integer" @@ -600,14 +415,28 @@ "stub_data_size": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "response": { + "type": "string" + }, + "rpc_version": { + "type": "string" + }, + "seqnum": { + "type": "integer" } - }, - "additionalProperties": false + } + }, + "dest_ip": { + "type": "string" + }, + "dest_port": { + "type": "integer" }, "dhcp": { "type": "object", + "additionalProperties": false, "properties": { "assigned_ip": { "type": "string" @@ -624,6 +453,13 @@ "dhcp_type": { "type": "string" }, + "dns_servers": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, "hostname": { "type": "string" }, @@ -636,6 +472,13 @@ "next_server_ip": { "type": "string" }, + "params": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, "rebinding_time": { "type": "integer" }, @@ -648,6 +491,13 @@ "requested_ip": { "type": "string" }, + "routers": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, "subnet_mask": { "type": "string" }, @@ -656,49 +506,44 @@ }, "vendor_class_identifier": { "type": "string" - }, - "dns_servers": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "params": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "routers": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } } - }, - "additionalProperties": false + } + }, + "direction": { + "type": "string" }, "dnp3": { "type": "object", + "additionalProperties": false, "properties": { - "dst": { - "type": "integer" - }, - "src": { - "type": "integer" - }, - "type": { - "type": "string" - }, "application": { "type": "object", + "additionalProperties": false, "properties": { "complete": { "type": "boolean" }, + "control": { + "type": "object", + "additionalProperties": false, + "properties": { + "con": { + "type": "boolean" + }, + "fin": { + "type": "boolean" + }, + "fir": { + "type": "boolean" + }, + "sequence": { + "type": "integer" + }, + "uns": { + "type": "boolean" + } + } + }, "function_code": { "type": "integer" }, @@ -707,6 +552,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "count": { "type": "integer" @@ -714,6 +560,13 @@ "group": { "type": "integer" }, + "points": { + "type": "array", + "minItems": 1, + "items": { + "type": "object" + } + }, "prefix_code": { "type": "integer" }, @@ -731,45 +584,15 @@ }, "variation": { "type": "integer" - }, - "points": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "additionalProperties": true - } } - }, - "additionalProperties": false - } - }, - "control": { - "type": "object", - "properties": { - "con": { - "type": "boolean" - }, - "fin": { - "type": "boolean" - }, - "fir": { - "type": "boolean" - }, - "sequence": { - "type": "integer" - }, - "uns": { - "type": "boolean" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "control": { "type": "object", + "additionalProperties": false, "properties": { "dir": { "type": "boolean" @@ -786,11 +609,14 @@ "pri": { "type": "boolean" } - }, - "additionalProperties": false + } + }, + "dst": { + "type": "integer" }, "iin": { "type": "object", + "additionalProperties": false, "properties": { "indicators": { "type": "array", @@ -799,27 +625,40 @@ "type": "string" } } - }, - "additionalProperties": false + } }, "request": { "type": "object", + "additionalProperties": false, "properties": { - "dst": { - "type": "integer" - }, - "src": { - "type": "integer" - }, - "type": { - "type": "string" - }, "application": { "type": "object", + "additionalProperties": false, "properties": { "complete": { "type": "boolean" }, + "control": { + "type": "object", + "additionalProperties": false, + "properties": { + "con": { + "type": "boolean" + }, + "fin": { + "type": "boolean" + }, + "fir": { + "type": "boolean" + }, + "sequence": { + "type": "integer" + }, + "uns": { + "type": "boolean" + } + } + }, "function_code": { "type": "integer" }, @@ -828,6 +667,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "count": { "type": "integer" @@ -835,6 +675,13 @@ "group": { "type": "integer" }, + "points": { + "type": "array", + "minItems": 1, + "items": { + "type": "object" + } + }, "prefix_code": { "type": "integer" }, @@ -852,45 +699,15 @@ }, "variation": { "type": "integer" - }, - "points": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "additionalProperties": true - } } - }, - "additionalProperties": false - } - }, - "control": { - "type": "object", - "properties": { - "con": { - "type": "boolean" - }, - "fin": { - "type": "boolean" - }, - "fir": { - "type": "boolean" - }, - "sequence": { - "type": "integer" - }, - "uns": { - "type": "boolean" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "control": { "type": "object", + "additionalProperties": false, "properties": { "dir": { "type": "boolean" @@ -907,15 +724,8 @@ "pri": { "type": "boolean" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "response": { - "type": "object", - "properties": { + } + }, "dst": { "type": "integer" }, @@ -924,13 +734,41 @@ }, "type": { "type": "string" - }, + } + } + }, + "response": { + "type": "object", + "additionalProperties": false, + "properties": { "application": { "type": "object", + "additionalProperties": false, "properties": { "complete": { "type": "boolean" }, + "control": { + "type": "object", + "additionalProperties": false, + "properties": { + "con": { + "type": "boolean" + }, + "fin": { + "type": "boolean" + }, + "fir": { + "type": "boolean" + }, + "sequence": { + "type": "integer" + }, + "uns": { + "type": "boolean" + } + } + }, "function_code": { "type": "integer" }, @@ -939,6 +777,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "count": { "type": "integer" @@ -946,6 +785,13 @@ "group": { "type": "integer" }, + "points": { + "type": "array", + "minItems": 1, + "items": { + "type": "object" + } + }, "prefix_code": { "type": "integer" }, @@ -963,45 +809,15 @@ }, "variation": { "type": "integer" - }, - "points": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "additionalProperties": true - } } - }, - "additionalProperties": false - } - }, - "control": { - "type": "object", - "properties": { - "con": { - "type": "boolean" - }, - "fin": { - "type": "boolean" - }, - "fir": { - "type": "boolean" - }, - "sequence": { - "type": "integer" - }, - "uns": { - "type": "boolean" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "control": { "type": "object", + "additionalProperties": false, "properties": { "dir": { "type": "boolean" @@ -1018,11 +834,14 @@ "pri": { "type": "boolean" } - }, - "additionalProperties": false + } + }, + "dst": { + "type": "integer" }, "iin": { "type": "object", + "additionalProperties": false, "properties": { "indicators": { "type": "array", @@ -1031,17 +850,27 @@ "type": "string" } } - }, - "additionalProperties": false + } + }, + "src": { + "type": "integer" + }, + "type": { + "type": "string" } - }, - "additionalProperties": false + } + }, + "src": { + "type": "integer" + }, + "type": { + "type": "string" } - }, - "additionalProperties": false + } }, "dns": { "type": "object", + "additionalProperties": false, "required": [ "version" ], @@ -1049,61 +878,61 @@ "aa": { "type": "boolean" }, - "flags": { - "type": "string" - }, - "id": { - "type": "integer" - }, - "qr": { - "type": "boolean" - }, - "ra": { - "type": "boolean" - }, - "rcode": { - "type": "string", - "suricata": { - "keywords": [ - "dns.rcode" - ] - } - }, - "rd": { - "type": "boolean" - }, - "rrname": { - "type": "string" - }, - "rrtype": { - "type": "string" - }, - "tx_id": { - "type": "integer" - }, - "type": { - "type": "string" + "additionals": { + "$ref": "#/$defs/dns.additionals" }, - "version": { - "description": "The version of this EVE DNS event", - "type": "integer", - "suricata": { - "keywords": false + "answer": { + "type": "object", + "additionalProperties": false, + "properties": { + "additionals": { + "$ref": "#/$defs/dns.additionals" + }, + "authorities": { + "$ref": "#/$defs/dns.authorities" + }, + "flags": { + "type": "string" + }, + "id": { + "type": "integer" + }, + "opcode": { + "type": "integer", + "description": "DNS opcode as an integer" + }, + "qr": { + "type": "boolean" + }, + "ra": { + "type": "boolean" + }, + "rcode": { + "type": "string" + }, + "rd": { + "type": "boolean" + }, + "rrname": { + "type": "string" + }, + "rrtype": { + "type": "string" + }, + "type": { + "type": "string" + }, + "version": { + "type": "integer" + } } }, - "opcode": { - "description": "DNS opcode as an integer", - "type": "integer" - }, - "tc": { - "description": "DNS truncation flag", - "type": "boolean" - }, "answers": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "rdata": { "type": "string", @@ -1125,14 +954,12 @@ "rrtype": { "type": "string" }, - "ttl": { - "type": "integer" - }, "soa": { "$ref": "#/$defs/dns.soa" }, "srv": { "type": "object", + "additionalProperties": false, "properties": { "name": { "type": "string" @@ -1146,177 +973,39 @@ "weight": { "type": "integer" } - }, - "additionalProperties": false + } }, "sshfp": { - "description": - "A Secure Shell fingerprint, used to verify the system’s authenticity", "type": "object", + "additionalProperties": false, "properties": { - "fingerprint": { - "type": "string" - }, "algo": { "type": "integer" }, + "fingerprint": { + "type": "string" + }, "type": { "type": "integer" } }, - "additionalProperties": false - } - }, - "additionalProperties": false - } - }, - "authorities": { - "$ref": "#/$defs/dns.authorities" - }, - "additionals": { - "$ref": "#/$defs/dns.additionals" - }, - "query": { - "$comment": - "EVE DNS v2 style query logging; as of Suricata 8 only used in DNS records when v2 logging is enabled, not used for DNS records logged as part of an event.", - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "id": { - "type": "integer" - }, - "rrname": { - "type": "string" - }, - "rrtype": { - "type": "string" + "description": "A Secure Shell fingerprint, used to verify the system\u2019s authenticity" }, - "tx_id": { - "type": "integer" - }, - "type": { - "type": "string" - }, - "z": { - "type": "boolean" - }, - "opcode": { - "description": "DNS opcode as an integer", + "ttl": { "type": "integer" } - }, - "additionalProperties": false + } } }, - "queries": { - "$comment": "EVE DNS v3 style query logging.", - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "id": { - "type": "integer" - }, - "rrname": { - "type": "string", - "suricata": { - "keywords": [ - "dns.queries.rrname", - "dns.query" - ] - } - }, - "rrtype": { - "type": "string", - "suricata": { - "keywords": [ - "dns.rrtype" - ] - } - }, - "tx_id": { - "type": "integer" - }, - "type": { - "type": "string" - }, - "z": { - "type": "boolean" - }, - "opcode": { - "description": "DNS opcode as an integer", - "type": "integer", - "suricata": { - "keywords": [ - "dns.opcode" - ] - } - }, - "rrname_truncated": { - "description": - "Set to true if the rrname was too long and truncated by Suricata", - "type": "boolean" - } - }, - "additionalProperties": false - } + "authorities": { + "$ref": "#/$defs/dns.authorities" }, - "answer": { - "type": "object", - "properties": { - "flags": { - "type": "string" - }, - "id": { - "type": "integer" - }, - "qr": { - "type": "boolean" - }, - "ra": { - "type": "boolean" - }, - "rcode": { - "type": "string" - }, - "rd": { - "type": "boolean" - }, - "rrname": { - "type": "string" - }, - "rrtype": { - "type": "string" - }, - "type": { - "type": "string" - }, - "version": { - "type": "integer" - }, - "opcode": { - "description": "DNS opcode as an integer", - "type": "integer" - }, - "authorities": { - "$ref": "#/$defs/dns.authorities" - }, - "additionals": { - "$ref": "#/$defs/dns.additionals" - } - }, - "additionalProperties": false + "flags": { + "type": "string" }, "grouped": { - "desription": - "DNS fields grouped by type: alternative format, no direct keywords", "type": "object", - "suricata": { - "keywords": false - }, + "additionalProperties": false, "properties": { "A": { "type": "array", @@ -1379,6 +1068,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "name": { "type": "string" @@ -1392,128 +1082,269 @@ "weight": { "type": "integer" } - }, - "additionalProperties": false - } - }, - "TXT": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" + } } }, "SSHFP": { - "description": - "A Secure Shell fingerprint is used to verify the system’s authenticity", "type": "array", + "description": "A Secure Shell fingerprint is used to verify the system\u2019s authenticity", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { - "fingerprint": { - "type": "string" - }, "algo": { "type": "integer" }, + "fingerprint": { + "type": "string" + }, "type": { "type": "integer" } - }, - "additionalProperties": false + } + } + }, + "TXT": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" } } }, - "additionalProperties": false - }, - "z": { - "type": "boolean" - } - }, - "additionalProperties": false - }, - "drop": { - "type": "object", - "suricata": { - "keywords": false - }, - "properties": { - "ack": { - "type": "boolean" - }, - "fin": { - "type": "boolean" - }, - "flowlbl": { - "type": "integer" - }, - "hoplimit": { - "type": "integer" - }, - "tc": { - "type": "integer" - }, - "icmp_id": { - "type": "integer" - }, - "icmp_seq": { - "type": "integer" - }, - "ipid": { - "type": "integer" - }, - "len": { - "type": "integer" - }, - "psh": { - "type": "boolean" - }, - "rst": { - "type": "boolean" - }, - "syn": { - "type": "boolean" - }, - "tcpack": { - "type": "integer" - }, - "tcpres": { - "type": "integer" - }, - "tcpseq": { - "type": "integer" - }, - "tcpurgp": { - "type": "integer" - }, - "tcpwin": { - "type": "integer" - }, - "tos": { - "type": "integer" + "desription": "DNS fields grouped by type: alternative format, no direct keywords", + "suricata": { + "keywords": false + } }, - "ttl": { + "id": { "type": "integer" }, - "udplen": { - "type": "integer" + "opcode": { + "type": "integer", + "description": "DNS opcode as an integer" }, - "urg": { + "qr": { "type": "boolean" }, - "reason": { - "type": "string" - }, - "verdict": { - "$ref": "#/$defs/verdict_type" - } - }, - "additionalProperties": false + "queries": { + "type": "array", + "$comment": "EVE DNS v3 style query logging.", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "integer" + }, + "opcode": { + "type": "integer", + "description": "DNS opcode as an integer", + "suricata": { + "keywords": [ + "dns.opcode" + ] + } + }, + "rrname": { + "type": "string", + "suricata": { + "keywords": [ + "dns.queries.rrname", + "dns.query" + ] + } + }, + "rrname_truncated": { + "type": "boolean", + "description": "Set to true if the rrname was too long and truncated by Suricata" + }, + "rrtype": { + "type": "string", + "suricata": { + "keywords": [ + "dns.rrtype" + ] + } + }, + "tx_id": { + "type": "integer" + }, + "type": { + "type": "string" + }, + "z": { + "type": "boolean" + } + } + } + }, + "query": { + "type": "array", + "$comment": "EVE DNS v2 style query logging; as of Suricata 8 only used in DNS records when v2 logging is enabled, not used for DNS records logged as part of an event.", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "id": { + "type": "integer" + }, + "opcode": { + "type": "integer", + "description": "DNS opcode as an integer" + }, + "rrname": { + "type": "string" + }, + "rrtype": { + "type": "string" + }, + "tx_id": { + "type": "integer" + }, + "type": { + "type": "string" + }, + "z": { + "type": "boolean" + } + } + } + }, + "ra": { + "type": "boolean" + }, + "rcode": { + "type": "string", + "suricata": { + "keywords": [ + "dns.rcode" + ] + } + }, + "rd": { + "type": "boolean" + }, + "rrname": { + "type": "string" + }, + "rrtype": { + "type": "string" + }, + "tc": { + "type": "boolean", + "description": "DNS truncation flag" + }, + "tx_id": { + "type": "integer" + }, + "type": { + "type": "string" + }, + "version": { + "type": "integer", + "description": "The version of this EVE DNS event", + "suricata": { + "keywords": false + } + }, + "z": { + "type": "boolean" + } + } + }, + "drop": { + "type": "object", + "additionalProperties": false, + "properties": { + "ack": { + "type": "boolean" + }, + "fin": { + "type": "boolean" + }, + "flowlbl": { + "type": "integer" + }, + "hoplimit": { + "type": "integer" + }, + "icmp_id": { + "type": "integer" + }, + "icmp_seq": { + "type": "integer" + }, + "ipid": { + "type": "integer" + }, + "len": { + "type": "integer" + }, + "psh": { + "type": "boolean" + }, + "reason": { + "type": "string" + }, + "rst": { + "type": "boolean" + }, + "syn": { + "type": "boolean" + }, + "tc": { + "type": "integer" + }, + "tcpack": { + "type": "integer" + }, + "tcpres": { + "type": "integer" + }, + "tcpseq": { + "type": "integer" + }, + "tcpurgp": { + "type": "integer" + }, + "tcpwin": { + "type": "integer" + }, + "tos": { + "type": "integer" + }, + "ttl": { + "type": "integer" + }, + "udplen": { + "type": "integer" + }, + "urg": { + "type": "boolean" + }, + "verdict": { + "$ref": "#/$defs/verdict_type" + } + }, + "suricata": { + "keywords": false + } }, "email": { "type": "object", + "additionalProperties": false, "properties": { + "attachment": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, "body_md5": { "type": "string" }, @@ -1539,6 +1370,9 @@ "has_ipv6_url": { "type": "boolean" }, + "message_id": { + "type": "string" + }, "received": { "type": "array", "minItems": 1, @@ -1571,22 +1405,12 @@ }, "x_mailer": { "type": "string" - }, - "attachment": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, - "message_id": { - "type": "string" } - }, - "additionalProperties": false + } }, "engine": { "type": "object", + "additionalProperties": false, "properties": { "error": { "type": "string" @@ -1597,71 +1421,37 @@ "message": { "type": "string" }, - "thread_name": { + "module": { "type": "string" }, - "module": { + "thread_name": { "type": "string" } - }, - "additionalProperties": false + } }, "enip": { "type": "object", + "additionalProperties": false, "properties": { "request": { "type": "object", + "additionalProperties": false, "properties": { - "command": { - "type": "string" - }, - "status": { - "type": "string" - }, - "register_session": { - "type": "object", - "properties": { - "protocol_version": { - "type": "integer" - }, - "options": { - "type": "integer" - } - }, - "additionalProperties": false - }, "cip": { "type": "object", + "additionalProperties": false, "properties": { - "service": { + "class_name": { "type": "string" }, - "path": { + "multiple": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { - "segment_type": { - "type": "string" - }, - "value": { - "type": "integer" - } - }, - "additionalProperties": false - } - }, - "class_name": { - "type": "string" - }, - "multiple": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "service": { + "class_name": { "type": "string" }, "path": { @@ -1669,6 +1459,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "segment_type": { "type": "string" @@ -1676,151 +1467,177 @@ "value": { "type": "integer" } - }, - "additionalProperties": false + } } }, - "class_name": { + "service": { "type": "string" } - }, - "additionalProperties": false + } } + }, + "path": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "segment_type": { + "type": "string" + }, + "value": { + "type": "integer" + } + } + } + }, + "service": { + "type": "string" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "response": { - "type": "object", - "properties": { - "command": { - "type": "string" + } }, - "status": { + "command": { "type": "string" }, "register_session": { "type": "object", + "additionalProperties": false, "properties": { - "protocol_version": { + "options": { "type": "integer" }, - "options": { + "protocol_version": { "type": "integer" } - }, - "additionalProperties": false + } }, - "list_services": { + "status": { + "type": "string" + } + } + }, + "response": { + "type": "object", + "additionalProperties": false, + "properties": { + "cip": { "type": "object", + "additionalProperties": false, "properties": { - "protocol_version": { - "type": "integer" + "multiple": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "service": { + "type": "string" + }, + "status": { + "type": "string" + }, + "status_extended": { + "type": "string" + }, + "status_extended_meaning": { + "type": "string" + } + } + } }, - "capabilities": { - "type": "integer" + "service": { + "type": "string" }, - "service_name": { + "status": { + "type": "string" + }, + "status_extended": { + "type": "string" + }, + "status_extended_meaning": { "type": "string" } - }, - "additionalProperties": false + } + }, + "command": { + "type": "string" }, "identity": { "type": "object", + "additionalProperties": false, "properties": { - "protocol_version": { + "device_type": { + "type": "string" + }, + "product_code": { "type": "integer" }, - "revision": { + "product_name": { "type": "string" }, - "vendor_id": { - "type": "string" + "protocol_version": { + "type": "integer" }, - "device_type": { + "revision": { "type": "string" }, - "product_code": { + "serial": { "type": "integer" }, - "status": { + "state": { "type": "integer" }, - "serial": { + "status": { "type": "integer" }, - "product_name": { + "vendor_id": { "type": "string" - }, - "state": { - "type": "integer" } - }, - "additionalProperties": false + } }, - "cip": { + "list_services": { "type": "object", + "additionalProperties": false, "properties": { - "service": { - "type": "string" - }, - "status": { - "type": "string" + "capabilities": { + "type": "integer" }, - "status_extended": { - "type": "string" + "protocol_version": { + "type": "integer" }, - "status_extended_meaning": { + "service_name": { "type": "string" + } + } + }, + "register_session": { + "type": "object", + "additionalProperties": false, + "properties": { + "options": { + "type": "integer" }, - "multiple": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "service": { - "type": "string" - }, - "status": { - "type": "string" - }, - "status_extended": { - "type": "string" - }, - "status_extended_meaning": { - "type": "string" - } - }, - "additionalProperties": false - } + "protocol_version": { + "type": "integer" } - }, - "additionalProperties": false + } + }, + "status": { + "type": "string" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "ether": { "type": "object", + "additionalProperties": false, "properties": { "dest_mac": { "type": "string" }, - "src_mac": { - "type": "string" - }, - "ether_type": { - "type": "integer", - "description": "Ethernet type value " - }, "dest_macs": { "type": "array", "minItems": 1, @@ -1828,6 +1645,13 @@ "type": "string" } }, + "ether_type": { + "type": "integer", + "description": "Ethernet type value " + }, + "src_mac": { + "type": "string" + }, "src_macs": { "type": "array", "minItems": 1, @@ -1835,11 +1659,14 @@ "type": "string" } } - }, - "additionalProperties": false + } + }, + "event_type": { + "type": "string" }, "fileinfo": { "type": "object", + "additionalProperties": false, "properties": { "end": { "type": "integer" @@ -1865,6 +1692,13 @@ "sha256": { "type": "string" }, + "sid": { + "type": "array", + "minItems": 1, + "items": { + "type": "integer" + } + }, "size": { "type": "integer" }, @@ -1878,62 +1712,112 @@ "type": "boolean" }, "storing": { - "description": "the file is set to be stored when completed", - "type": "boolean" + "type": "boolean", + "description": "the file is set to be stored when completed" }, "tx_id": { "type": "integer" - }, - "sid": { - "type": "array", - "minItems": 1, - "items": { - "type": "integer" - } } - }, - "additionalProperties": false + } }, - "flow": { - "type": "object", - "properties": { - "action": { - "type": "string" - }, - "age": { - "type": "integer", - "suricata": { - "keywords" : [ - "flow.age" - ] - } - }, - "alerted": { - "type": "boolean" - }, - "elephant": { - "type": "boolean" - }, - "bypass": { - "type": "string" - }, - "bypassed": { - "type": "object", - "properties": { - "pkts_toserver": { - "type": "integer" - }, - "pkts_toclient": { - "type": "integer" - }, - "bytes_toserver": { - "type": "integer" - }, - "bytes_toclient": { - "type": "integer" - } - }, - "additionalProperties": false + "files": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "end": { + "type": "integer" + }, + "file_id": { + "type": "integer" + }, + "filename": { + "type": "string" + }, + "gaps": { + "type": "boolean" + }, + "magic": { + "type": "string" + }, + "md5": { + "type": "string" + }, + "sha1": { + "type": "string" + }, + "sha256": { + "type": "string" + }, + "sid": { + "type": "array", + "minItems": 1, + "items": { + "type": "integer" + } + }, + "size": { + "type": "integer" + }, + "start": { + "type": "integer" + }, + "state": { + "type": "string" + }, + "stored": { + "type": "boolean" + }, + "storing": { + "type": "boolean", + "description": "the file is set to be stored when completed" + }, + "tx_id": { + "type": "integer" + } + } + } + }, + "flow": { + "type": "object", + "additionalProperties": false, + "properties": { + "action": { + "type": "string" + }, + "age": { + "type": "integer", + "suricata": { + "keywords": [ + "flow.age" + ] + } + }, + "alerted": { + "type": "boolean" + }, + "bypass": { + "type": "string" + }, + "bypassed": { + "type": "object", + "additionalProperties": false, + "properties": { + "bytes_toclient": { + "type": "integer" + }, + "bytes_toserver": { + "type": "integer" + }, + "pkts_toclient": { + "type": "integer" + }, + "pkts_toserver": { + "type": "integer" + } + } }, "bytes_toclient": { "type": "integer", @@ -1959,6 +1843,9 @@ "dest_port": { "type": "integer" }, + "elephant": { + "type": "boolean" + }, "emergency": { "type": "boolean" }, @@ -1966,19 +1853,18 @@ "type": "string" }, "exception_policy": { - "description": - "The exception policy(ies) triggered by the flow. Not logged if none was triggered", "type": "array", "properties": { - "target": { - "description": "What triggered the exception", - "type": "string" - }, "policy": { - "description": "Which exception policy was applied", - "type": "string" + "type": "string", + "description": "Which exception policy was applied" + }, + "target": { + "type": "string", + "description": "What triggered the exception" } - } + }, + "description": "The exception policy(ies) triggered by the flow. Not logged if none was triggered" }, "pkts_toclient": { "type": "integer", @@ -2018,50 +1904,53 @@ ] } }, - "wrong_thread": { - "type": "boolean" - }, "tx_cnt": { "type": "integer" + }, + "wrong_thread": { + "type": "boolean" } - }, - "additionalProperties": false + } + }, + "flow_id": { + "type": "integer" }, "frame": { "type": "object", + "additionalProperties": false, "properties": { - "type": { - "type": "string" - }, - "id": { - "type": "integer" + "complete": { + "type": "boolean" }, "direction": { "type": "string" }, - "stream_offset": { + "id": { "type": "integer" }, "length": { "type": "integer" }, - "complete": { - "type": "boolean" - }, "payload": { "type": "string" }, "payload_printable": { "type": "string" }, + "stream_offset": { + "type": "integer" + }, "tx_id": { "type": "integer" + }, + "type": { + "type": "string" } - }, - "additionalProperties": false + } }, "ftp": { "type": "object", + "additionalProperties": false, "properties": { "command": { "type": "string" @@ -2072,18 +1961,6 @@ "command_truncated": { "type": "boolean" }, - "dynamic_port": { - "type": "integer" - }, - "mode": { - "type": "string" - }, - "reply_received": { - "type": "string" - }, - "reply_truncated": { - "type": "boolean" - }, "completion_code": { "type": "array", "minItems": 1, @@ -2091,18 +1968,30 @@ "type": "string" } }, + "dynamic_port": { + "type": "integer" + }, + "mode": { + "type": "string" + }, "reply": { "type": "array", "minItems": 1, "items": { "type": "string" } + }, + "reply_received": { + "type": "string" + }, + "reply_truncated": { + "type": "boolean" } - }, - "additionalProperties": false + } }, "ftp_data": { "type": "object", + "additionalProperties": false, "properties": { "command": { "type": "string" @@ -2110,15 +1999,106 @@ "filename": { "type": "string" } - }, - "additionalProperties": false + } + }, + "host": { + "type": "string", + "$comment": "May change to sensor_name in the future, or become user configurable: https://redmine.openinfosecfoundation.org/issues/4919", + "description": "the sensor-name, if configured" }, "http": { "type": "object", + "additionalProperties": false, "properties": { + "content_range": { + "type": "object", + "additionalProperties": false, + "properties": { + "end": { + "type": "integer" + }, + "raw": { + "type": "string" + }, + "size": { + "type": "integer" + }, + "start": { + "type": "integer" + } + } + }, "hostname": { "type": "string" }, + "http2": { + "type": "object", + "additionalProperties": false, + "properties": { + "request": { + "type": "object", + "additionalProperties": false, + "properties": { + "error_code": { + "type": "string" + }, + "has_multiple": { + "type": "string" + }, + "priority": { + "type": "integer" + }, + "settings": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "settings_id": { + "type": "string" + }, + "settings_value": { + "type": "integer" + } + } + } + } + } + }, + "response": { + "type": "object", + "additionalProperties": false, + "properties": { + "error_code": { + "type": "string" + }, + "has_multiple": { + "type": "string" + }, + "settings": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "settings_id": { + "type": "string" + }, + "settings_value": { + "type": "integer" + } + } + } + } + } + }, + "stream_id": { + "type": "integer" + } + } + }, "http_content_type": { "type": "string" }, @@ -2152,33 +2132,12 @@ "redirect": { "type": "string" }, - "status": { - "type": "integer" - }, - "status_string": { - "description": "status string when it is not a valid integer (like 2XX)", - "type": "string" - }, - "true_client_ip": { - "type": "string" - }, - "url": { - "type": "string" - }, - "version": { - "type": "string" - }, - "x_bluecoat_via": { - "type": "string" - }, - "xff": { - "type": "string" - }, "request_headers": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "name": { "type": "string" @@ -2189,8 +2148,7 @@ "value": { "type": "string" } - }, - "additionalProperties": false + } } }, "response_headers": { @@ -2198,6 +2156,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "name": { "type": "string" @@ -2208,102 +2167,42 @@ "value": { "type": "string" } - }, - "additionalProperties": false + } } }, - "content_range": { - "type": "object", - "properties": { - "end": { - "type": "integer" - }, - "raw": { - "type": "string" - }, - "size": { - "type": "integer" - }, - "start": { - "type": "integer" - } - }, - "additionalProperties": false + "status": { + "type": "integer" }, - "http2": { - "type": "object", - "properties": { - "stream_id": { - "type": "integer" - }, - "request": { - "type": "object", - "properties": { - "error_code": { - "type": "string" - }, - "priority": { - "type": "integer" - }, - "has_multiple": { - "type": "string" - }, - "settings": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "settings_id": { - "type": "string" - }, - "settings_value": { - "type": "integer" - } - }, - "additionalProperties": false - } - } - }, - "additionalProperties": false - }, - "response": { - "type": "object", - "properties": { - "error_code": { - "type": "string" - }, - "has_multiple": { - "type": "string" - }, - "settings": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "settings_id": { - "type": "string" - }, - "settings_value": { - "type": "integer" - } - }, - "additionalProperties": false - } - } - }, - "additionalProperties": false - } - }, - "additionalProperties": false + "status_string": { + "type": "string", + "description": "status string when it is not a valid integer (like 2XX)" + }, + "true_client_ip": { + "type": "string" + }, + "url": { + "type": "string" + }, + "version": { + "type": "string" + }, + "x_bluecoat_via": { + "type": "string" + }, + "xff": { + "type": "string" } - }, - "additionalProperties": false + } + }, + "icmp_code": { + "type": "integer" + }, + "icmp_type": { + "type": "integer" }, "ike": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "alg_auth": { "type": "string" @@ -2335,67 +2234,13 @@ "exchange_type_verbose": { "type": "string" }, - "init_spi": { - "type": "string" - }, - "message_id": { - "type": "integer" - }, - "resp_spi": { - "type": "string" - }, - "role": { - "type": "string" - }, - "sa_key_length": { - "type": "string" - }, - "sa_key_length_raw": { - "type": "integer" - }, - "sa_life_duration": { - "type": "string" - }, - "sa_life_duration_raw": { - "type": "integer" - }, - "sa_life_type": { - "type": "string" - }, - "sa_life_type_raw": { - "type": "integer" - }, - "version_major": { - "type": "integer" - }, - "version_minor": { - "type": "integer" - }, - "payload": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, "ikev1": { "type": "object", + "additionalProperties": false, "properties": { - "doi": { - "type": "integer" - }, - "encrypted_payloads": { - "type": "boolean" - }, - "vendor_ids": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - }, "client": { "type": "object", + "additionalProperties": false, "properties": { "key_exchange_payload": { "type": "string" @@ -2414,6 +2259,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "alg_auth": { "type": "string" @@ -2457,15 +2303,20 @@ "sa_life_type_raw": { "type": "integer" } - }, - "additionalProperties": false + } } } - }, - "additionalProperties": false + } + }, + "doi": { + "type": "integer" + }, + "encrypted_payloads": { + "type": "boolean" }, "server": { "type": "object", + "additionalProperties": false, "properties": { "key_exchange_payload": { "type": "string" @@ -2479,14 +2330,20 @@ "nonce_payload_length": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "vendor_ids": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } } - }, - "additionalProperties": false + } }, "ikev2": { "type": "object", + "additionalProperties": false, "properties": { "errors": { "type": "integer" @@ -2494,134 +2351,240 @@ "notify": { "type": "array" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "krb5": { - "type": "object", - "optional": true, - "properties": { - "cname": { - "type": "string" + } }, - "encryption": { + "init_spi": { "type": "string" }, - "error_code": { - "type": "string" + "message_id": { + "type": "integer" }, - "failed_request": { + "payload": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, + "resp_spi": { "type": "string" }, - "msg_type": { + "role": { "type": "string" }, - "realm": { + "sa_key_length": { "type": "string" }, - "sname": { + "sa_key_length_raw": { + "type": "integer" + }, + "sa_life_duration": { "type": "string" }, - "ticket_encryption": { + "sa_life_duration_raw": { + "type": "integer" + }, + "sa_life_type": { "type": "string" }, - "ticket_weak_encryption": { - "type": "boolean" + "sa_life_type_raw": { + "type": "integer" }, - "weak_encryption": { - "type": "boolean" - } - }, - "additionalProperties": false - }, - "ldap": { + "version_major": { + "type": "integer" + }, + "version_minor": { + "type": "integer" + } + }, + "optional": true + }, + "in_iface": { + "type": "string" + }, + "ip_v": { + "type": "integer", + "description": "IP version of the packet or flow" + }, + "krb5": { + "type": "object", + "additionalProperties": false, + "properties": { + "cname": { + "type": "string" + }, + "encryption": { + "type": "string" + }, + "error_code": { + "type": "string" + }, + "failed_request": { + "type": "string" + }, + "msg_type": { + "type": "string" + }, + "realm": { + "type": "string" + }, + "sname": { + "type": "string" + }, + "ticket_encryption": { + "type": "string" + }, + "ticket_weak_encryption": { + "type": "boolean" + }, + "weak_encryption": { + "type": "boolean" + } + }, + "optional": true + }, + "ldap": { "type": "object", - "optional": true, "properties": { "request": { "type": "object", + "additionalProperties": false, "properties": { - "operation": { - "type": "string" - }, - "message_id": { - "type": "integer" - }, - "search_request": { + "abandon_request": { "type": "object", - "optional": "true", "properties": { - "base_object": { - "type": "string" - }, - "scope": { - "type": "integer" - }, - "deref_alias": { - "type": "integer" - }, - "size_limit": { - "type": "integer" - }, - "time_limit": { + "message_id": { "type": "integer" - }, - "types_online": { - "type": "boolean" - }, + } + }, + "optional": "true" + }, + "add_request": { + "type": "object", + "properties": { "attributes": { "type": "array", "minItems": 1, "items": { - "type": "string" + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "values": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + } + } } + }, + "entry": { + "type": "string" } - } + }, + "optional": "true" }, "bind_request": { "type": "object", - "optional": "true", "properties": { - "version": { - "type": "integer" - }, "name": { "type": "string" }, "sasl": { "type": "object", - "optional": "true", "properties": { - "mechanism": { - "type": "string" - }, "credentials": { "type": "string", "optional": "true" + }, + "mechanism": { + "type": "string" + } + }, + "optional": "true" + }, + "version": { + "type": "integer" + } + }, + "optional": "true" + }, + "compare_request": { + "type": "object", + "properties": { + "attribute_value_assertion": { + "type": "object", + "properties": { + "description": { + "type": "string" + }, + "value": { + "type": "string" } } + }, + "entry": { + "type": "string" } - } + }, + "optional": "true" }, - "modify_request": { + "del_request": { "type": "object", - "optional": "true", "properties": { - "object": { + "dn": { + "type": "string" + } + }, + "optional": "true" + }, + "extended_request": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "value": { + "type": "string", + "optional": "true" + } + }, + "optional": "true" + }, + "message_id": { + "type": "integer" + }, + "mod_dn_request": { + "type": "object", + "properties": { + "delete_old_rdn": { + "type": "boolean" + }, + "entry": { "type": "string" }, + "new_rdn": { + "type": "string" + }, + "new_superior": { + "type": "string", + "optional": "true" + } + }, + "optional": "true" + }, + "modify_request": { + "type": "object", + "properties": { "changes": { "type": "array", "minItems": 1, "items": { "type": "object", "properties": { - "operation": { - "type": "string" - }, "modification": { "type": "object", "properties": { @@ -2636,112 +2599,54 @@ } } } + }, + "operation": { + "type": "string" } } } + }, + "object": { + "type": "string" } - } + }, + "optional": "true" }, - "add_request": { + "operation": { + "type": "string" + }, + "search_request": { "type": "object", - "optional": "true", "properties": { - "entry": { - "type": "string" - }, "attributes": { "type": "array", "minItems": 1, "items": { - "type": "object", - "properties": { - "name": { - "type": "string" - }, - "values": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } - } - } + "type": "string" } - } - } - }, - "del_request": { - "type": "object", - "optional": "true", - "properties": { - "dn": { - "type": "string" - } - } - }, - "mod_dn_request": { - "type": "object", - "optional": "true", - "properties": { - "entry": { - "type": "string" }, - "new_rdn": { + "base_object": { "type": "string" }, - "delete_old_rdn": { - "type": "boolean" + "deref_alias": { + "type": "integer" }, - "new_superior": { - "type": "string", - "optional": "true" - } - } - }, - "compare_request": { - "type": "object", - "optional": "true", - "properties": { - "entry": { - "type": "string" + "scope": { + "type": "integer" }, - "attribute_value_assertion": { - "type": "object", - "properties": { - "description": { - "type": "string" - }, - "value": { - "type": "string" - } - } - } - } - }, - "abandon_request": { - "type": "object", - "optional": "true", - "properties": { - "message_id": { + "size_limit": { "type": "integer" - } - } - }, - "extended_request": { - "type": "object", - "optional": "true", - "properties": { - "name": { - "type": "string" }, - "value": { - "type": "string", - "optional": "true" + "time_limit": { + "type": "integer" + }, + "types_online": { + "type": "boolean" } - } + }, + "optional": "true" } - }, - "additionalProperties": false + } }, "responses": { "type": "array", @@ -2750,156 +2655,160 @@ "items": { "type": "object", "properties": { - "search_result_done": { + "add_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" + }, + "result_code": { + "type": "string" } - } + }, + "optional": "true" }, "bind_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" }, + "result_code": { + "type": "string" + }, "server_sasl_creds": { "type": "string", "optional": "true" } - } + }, + "optional": "true" }, - "modify_response": { + "compare_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" + }, + "result_code": { + "type": "string" } - } + }, + "optional": "true" }, - "add_response": { + "del_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" + }, + "result_code": { + "type": "string" } - } + }, + "optional": "true" }, - "del_response": { + "extended_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" + }, + "name": { + "type": "string" + }, + "result_code": { + "type": "string" + }, + "value": { + "type": "string" } - } + }, + "optional": "true" }, - "mod_dn_response": { + "intermediate_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, - "matched_dn": { + "name": { "type": "string" }, - "message": { + "value": { "type": "string" } - } + }, + "optional": "true" }, - "compare_response": { + "mod_dn_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { + "matched_dn": { "type": "string" }, - "matched_dn": { + "message": { "type": "string" }, - "message": { + "result_code": { "type": "string" } - } + }, + "optional": "true" }, - "extended_response": { + "modify_response": { "type": "object", - "optional": "true", "properties": { - "result_code": { - "type": "string" - }, "matched_dn": { "type": "string" }, "message": { "type": "string" }, - "name": { - "type": "string" - }, - "value": { + "result_code": { "type": "string" } - } + }, + "optional": "true" }, - "intermediate_response": { + "search_result_done": { "type": "object", - "optional": "true", "properties": { - "name": { + "matched_dn": { "type": "string" }, - "value": { + "message": { + "type": "string" + }, + "result_code": { "type": "string" } - } + }, + "optional": "true" } } } } - } + }, + "optional": true + }, + "log_level": { + "type": "string" }, "metadata": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "flowbits": { "type": "array", @@ -2913,6 +2822,14 @@ ] } }, + "flowints": { + "type": "object", + "suricata": { + "keywords": [ + "flowint" + ] + } + }, "flowvars": { "type": "array", "minItems": 1, @@ -2928,8 +2845,7 @@ "value": { "type": "string" } - }, - "additionalProperties": true + } } }, "pktvars": { @@ -2937,6 +2853,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "uid": { "type": "string" @@ -2944,31 +2861,22 @@ "username": { "type": "string" } - }, - "additionalProperties": false - } - }, - "flowints": { - "type": "object", - "additionalProperties": true, - "suricata": { - "keywords": [ - "flowint" - ] + } } } }, - "additionalProperties": false + "optional": true }, "modbus": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "id": { "type": "integer" }, "request": { "type": "object", + "additionalProperties": false, "properties": { "access_type": { "type": "string" @@ -2979,26 +2887,9 @@ "data": { "type": "string" }, - "error_flags": { - "type": "string" - }, - "function_code": { - "type": "string" - }, - "function_raw": { - "type": "integer" - }, - "protocol_id": { - "type": "integer" - }, - "transaction_id": { - "type": "integer" - }, - "unit_id": { - "type": "integer" - }, "diagnostic": { "type": "object", + "additionalProperties": false, "properties": { "code": { "type": "string" @@ -3009,11 +2900,20 @@ "raw": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "error_flags": { + "type": "string" + }, + "function_code": { + "type": "string" + }, + "function_raw": { + "type": "integer" }, "mei": { "type": "object", + "additionalProperties": false, "properties": { "code": { "type": "string" @@ -3024,11 +2924,14 @@ "raw": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "protocol_id": { + "type": "integer" }, "read": { "type": "object", + "additionalProperties": false, "properties": { "address": { "type": "integer" @@ -3036,11 +2939,17 @@ "quantity": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "transaction_id": { + "type": "integer" + }, + "unit_id": { + "type": "integer" }, "write": { "type": "object", + "additionalProperties": false, "properties": { "address": { "type": "integer" @@ -3048,14 +2957,13 @@ "data": { "type": "integer" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "response": { "type": "object", + "additionalProperties": false, "properties": { "access_type": { "type": "string" @@ -3066,26 +2974,9 @@ "data": { "type": "string" }, - "error_flags": { - "type": "string" - }, - "function_code": { - "type": "string" - }, - "function_raw": { - "type": "integer" - }, - "protocol_id": { - "type": "integer" - }, - "transaction_id": { - "type": "integer" - }, - "unit_id": { - "type": "integer" - }, "diagnostic": { "type": "object", + "additionalProperties": false, "properties": { "code": { "type": "string" @@ -3096,11 +2987,14 @@ "raw": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "error_flags": { + "type": "string" }, "exception": { "type": "object", + "additionalProperties": false, "properties": { "code": { "type": "string" @@ -3108,20 +3002,35 @@ "raw": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "function_code": { + "type": "string" + }, + "function_raw": { + "type": "integer" + }, + "protocol_id": { + "type": "integer" }, "read": { "type": "object", + "additionalProperties": false, "properties": { "data": { "type": "string" } - }, - "additionalProperties": false + } + }, + "transaction_id": { + "type": "integer" + }, + "unit_id": { + "type": "integer" }, "write": { "type": "object", + "additionalProperties": false, "properties": { "address": { "type": "integer" @@ -3129,25 +3038,27 @@ "data": { "type": "integer" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } } }, - "additionalProperties": false + "optional": true }, "mqtt": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "connack": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" }, + "properties": { + "type": "object" + }, "qos": { "type": "integer" }, @@ -3159,16 +3070,12 @@ }, "session_present": { "type": "boolean" - }, - "properties": { - "type": "object", - "additionalProperties": true } - }, - "additionalProperties": false + } }, "connect": { "type": "object", + "additionalProperties": false, "properties": { "client_id": { "type": "string" @@ -3176,26 +3083,9 @@ "dup": { "type": "boolean" }, - "password": { - "type": "string" - }, - "protocol_string": { - "type": "string" - }, - "protocol_version": { - "type": "integer" - }, - "qos": { - "type": "integer" - }, - "retain": { - "type": "boolean" - }, - "username": { - "type": "string" - }, "flags": { "type": "object", + "additionalProperties": false, "properties": { "clean_session": { "type": "boolean" @@ -3212,38 +3102,56 @@ "will_retain": { "type": "boolean" } - }, - "additionalProperties": false + } + }, + "password": { + "type": "string" }, "properties": { - "type": "object", - "additionalProperties": true + "type": "object" + }, + "protocol_string": { + "type": "string" + }, + "protocol_version": { + "type": "integer" + }, + "qos": { + "type": "integer" + }, + "retain": { + "type": "boolean" + }, + "username": { + "type": "string" }, "will": { "type": "object", + "additionalProperties": false, "properties": { "message": { "type": "string" }, + "properties": { + "type": "object" + }, "topic": { "type": "string" - }, - "properties": { - "type": "object", - "additionalProperties": true } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "disconnect": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" }, + "properties": { + "type": "object" + }, "qos": { "type": "integer" }, @@ -3252,16 +3160,12 @@ }, "retain": { "type": "boolean" - }, - "properties": { - "type": "object", - "additionalProperties": true } - }, - "additionalProperties": false + } }, "pingreq": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3272,11 +3176,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "pingresp": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3287,11 +3191,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "puback": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3308,11 +3212,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "pubcomp": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3329,11 +3233,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "publish": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3344,6 +3248,9 @@ "message_id": { "type": "integer" }, + "properties": { + "type": "object" + }, "qos": { "type": "integer" }, @@ -3358,16 +3265,12 @@ }, "truncated": { "type": "boolean" - }, - "properties": { - "type": "object", - "additionalProperties": true } - }, - "additionalProperties": false + } }, "pubrec": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3384,11 +3287,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "pubrel": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3405,11 +3308,11 @@ "retain": { "type": "boolean" } - }, - "additionalProperties": false + } }, "suback": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3420,21 +3323,21 @@ "qos": { "type": "integer" }, - "retain": { - "type": "boolean" - }, "qos_granted": { "type": "array", "minItems": 1, "items": { "type": "integer" } + }, + "retain": { + "type": "boolean" } - }, - "additionalProperties": false + } }, "subscribe": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3453,6 +3356,7 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "qos": { "type": "integer" @@ -3460,15 +3364,14 @@ "topic": { "type": "string" } - }, - "additionalProperties": false + } } } - }, - "additionalProperties": false + } }, "unsuback": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3479,21 +3382,21 @@ "qos": { "type": "integer" }, - "retain": { - "type": "boolean" - }, "reason_codes": { "type": "array", "minItems": 1, "items": { "type": "integer" } + }, + "retain": { + "type": "boolean" } - }, - "additionalProperties": false + } }, "unsubscribe": { "type": "object", + "additionalProperties": false, "properties": { "dup": { "type": "boolean" @@ -3514,15 +3417,18 @@ "type": "string" } } - }, - "additionalProperties": false + } } }, - "additionalProperties": false + "optional": true + }, + "ndpi": { + "type": "object", + "description": "nDPI plugin, contents provided by 3rd party library" }, "netflow": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "age": { "type": "integer" @@ -3549,11 +3455,11 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true }, "nfs": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "file_tx": { "type": "boolean" @@ -3570,18 +3476,9 @@ "procedure": { "type": "string" }, - "status": { - "type": "string" - }, - "type": { - "type": "string" - }, - "version": { - "type": "integer" - }, "read": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "chunks": { "type": "integer" @@ -3596,11 +3493,11 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true }, "rename": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "from": { "type": "string" @@ -3609,11 +3506,20 @@ "type": "string" } }, - "additionalProperties": false + "optional": true + }, + "status": { + "type": "string" + }, + "type": { + "type": "string" + }, + "version": { + "type": "integer" }, "write": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "chunks": { "type": "integer" @@ -3628,14 +3534,17 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true } }, - "additionalProperties": false + "optional": true + }, + "packet": { + "type": "string" }, "packet_info": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "linktype": { "type": "integer" @@ -3645,14 +3554,33 @@ "description": "the descriptive name of the linktype" } }, - "additionalProperties": false + "optional": true + }, + "parent_id": { + "type": "integer" + }, + "payload": { + "type": "string" + }, + "payload_length": { + "type": "integer" + }, + "payload_printable": { + "type": "string" + }, + "pcap_cnt": { + "type": "integer" + }, + "pcap_filename": { + "type": "string" }, "pgsql": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "request": { "type": "object", + "additionalProperties": false, "properties": { "message": { "type": "string" @@ -3687,6 +3615,7 @@ }, "startup_parameters": { "type": "object", + "additionalProperties": false, "properties": { "optional_parameters": { "type": "array", @@ -3715,21 +3644,19 @@ "replication": { "type": "string" } - }, - "additionalProperties": true + } } }, "user": { "type": "string" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "response": { "type": "object", + "additionalProperties": false, "properties": { "authentication_md5_password": { "type": "string" @@ -3740,19 +3667,27 @@ "code": { "type": "string" }, + "command_completed": { + "type": "string" + }, "copy_data_out": { "type": "object", "properties": { - "row_count": { + "data_size": { "type": "integer" }, - "data_size": { + "row_count": { "type": "integer" } } }, - "command_completed": { - "type": "string" + "copy_out_response": { + "type": "object", + "properties": { + "copy_column_count": { + "type": "integer" + } + } }, "data_rows": { "type": "integer" @@ -3811,8 +3746,7 @@ "time_zone": { "type": "string" } - }, - "additionalProperties": true + } } }, "process_id": { @@ -3830,191 +3764,178 @@ "severity_non_localizable": { "type": "string" }, - "copy_out_response": { - "type": "object", - "properties": { - "copy_column_count": { - "type": "integer" - } - } - }, "ssl_accepted": { "type": "boolean" } - }, - "additionalProperties": false + } }, "tx_id": { "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "pkt_src": { + "type": "string" }, "pop3": { "type": "object", - "optional": true, "properties": { "request": { "type": "object", - "optional": true, "properties": { - "command": { - "description": "a pop3 command, for example `USER` or `STAT`", - "type": "string" - }, "args": { - "description": "pop3 request arguments", "type": "array", + "description": "pop3 request arguments", "items": { "type": "string" } + }, + "command": { + "type": "string", + "description": "a pop3 command, for example `USER` or `STAT`" } - } + }, + "optional": true }, "response": { "type": "object", - "optional": true, "properties": { - "success": { - "description": "response indicated positive status ie +OK", - "type": "boolean" - }, - "status": { - "type": "string" - }, - "header": { - "description": "first line of response", - "type": "string" - }, "data": { "type": "array", "items": { "type": "string" } + }, + "header": { + "type": "string", + "description": "first line of response" + }, + "status": { + "type": "string" + }, + "success": { + "type": "boolean", + "description": "response indicated positive status ie +OK" } - } + }, + "optional": true } - } + }, + "optional": true + }, + "proto": { + "type": "string" }, "quic": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "cyu": { - "description": - "ja3-like fingerprint for versions of QUIC before standardization", "type": "array", + "description": "ja3-like fingerprint for versions of QUIC before standardization", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "hash": { - "description": "cyu hash hex representation", - "type": "string" + "type": "string", + "description": "cyu hash hex representation" }, "string": { - "description": "cyu hash string representation", - "type": "string" + "type": "string", + "description": "cyu hash string representation" } - }, - "additionalProperties": false + } } }, "extensions": { - "description": "list of extensions in hello", "type": "array", + "description": "list of extensions in hello", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "name": { - "description": "human-friendly name of the extension", - "type": "string" + "type": "string", + "description": "human-friendly name of the extension" }, "type": { - "description": "integer identifier of the extension", - "type": "integer" + "type": "integer", + "description": "integer identifier of the extension" }, "values": { - "description": "extension values", "type": "array", + "description": "extension values", "minItems": 1, "items": { "type": "string" } } - }, - "additionalProperties": false + } } }, "ja3": { - "description": "ja3 from client, as in TLS", "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "hash": { - "description": "ja3 hex representation", - "type": "string" + "type": "string", + "description": "ja3 hex representation" }, "string": { - "description": "ja3 string representation", - "type": "string" + "type": "string", + "description": "ja3 string representation" } }, - "additionalProperties": false + "description": "ja3 from client, as in TLS", + "optional": true }, "ja3s": { - "description": "ja3 from server, as in TLS", "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "hash": { - "description": "ja3s hex representation", - "type": "string" + "type": "string", + "description": "ja3s hex representation" }, "string": { - "description": "ja3s string representation", - "type": "string" + "type": "string", + "description": "ja3s string representation" } }, - "additionalProperties": false + "description": "ja3 from server, as in TLS", + "optional": true }, "ja4": { + "type": "string", "suricata": { "keywords": [ "ja4.hash" ] - }, - "type": "string" + } }, "sni": { - "description": "Server Name Indication", - "type": "string" + "type": "string", + "description": "Server Name Indication" }, "ua": { - "description": "User Agent for versions of QUIC before standardization", - "type": "string" + "type": "string", + "description": "User Agent for versions of QUIC before standardization" }, "version": { - "description": "Quic protocol version", - "type": "string" + "type": "string", + "description": "Quic protocol version" } }, - "additionalProperties": false + "optional": true }, "rdp": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { - "cookie": { - "type": "string" - }, - "event_type": { - "type": "string" - }, - "tx_id": { - "type": "integer" - }, "channels": { "type": "array", "minItems": 1, @@ -4024,10 +3945,18 @@ }, "client": { "type": "object", + "additionalProperties": false, "properties": { "build": { "type": "string" }, + "capabilities": { + "type": "array", + "minItems": 1, + "items": { + "type": "string" + } + }, "client_name": { "type": "string" }, @@ -4057,29 +3986,34 @@ }, "version": { "type": "string" - }, - "capabilities": { - "type": "array", - "minItems": 1, - "items": { - "type": "string" - } } - }, - "additionalProperties": false + } + }, + "cookie": { + "type": "string" + }, + "event_type": { + "type": "string" + }, + "tx_id": { + "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "response_icmp_code": { + "type": "integer" + }, + "response_icmp_type": { + "type": "integer" }, "rfb": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { - "screen_shared": { - "type": "boolean" - }, "authentication": { "type": "object", + "additionalProperties": false, "properties": { "security_result": { "type": "string" @@ -4089,6 +4023,7 @@ }, "vnc": { "type": "object", + "additionalProperties": false, "properties": { "challenge": { "type": "string" @@ -4096,14 +4031,13 @@ "response": { "type": "string" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "client_protocol_version": { "type": "object", + "additionalProperties": false, "properties": { "major": { "type": "string" @@ -4111,11 +4045,11 @@ "minor": { "type": "string" } - }, - "additionalProperties": false + } }, "framebuffer": { "type": "object", + "additionalProperties": false, "properties": { "height": { "type": "integer" @@ -4123,11 +4057,9 @@ "name": { "type": "string" }, - "width": { - "type": "integer" - }, "pixel_format": { "type": "object", + "additionalProperties": false, "properties": { "big_endian": { "type": "boolean" @@ -4159,14 +4091,19 @@ "true_color": { "type": "boolean" } - }, - "additionalProperties": false + } + }, + "width": { + "type": "integer" } - }, - "additionalProperties": false + } + }, + "screen_shared": { + "type": "boolean" }, "server_protocol_version": { "type": "object", + "additionalProperties": false, "properties": { "major": { "type": "string" @@ -4174,28 +4111,21 @@ "minor": { "type": "string" } - }, - "additionalProperties": false + } } }, - "additionalProperties": false + "optional": true }, "rpc": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { - "auth_type": { - "type": "string" - }, - "status": { - "type": "string" - }, - "xid": { - "type": "integer" + "auth_type": { + "type": "string" }, "creds": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "gid": { "type": "integer" @@ -4207,14 +4137,20 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "status": { + "type": "string" + }, + "xid": { + "type": "integer" } }, - "additionalProperties": false + "optional": true }, "sip": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "code": { "type": "string" @@ -4231,108 +4167,43 @@ "response_line": { "type": "string" }, - "uri": { - "type": "string" - }, - "version": { - "type": "string" - }, "sdp": { "type": "object", - "description": "SDP message body", - "optional": true, + "additionalProperties": false, "properties": { - "version": { - "type": "integer", - "description": "SDP protocol version" - }, - "origin": { - "type": "string", - "description": "Owner of the session" - }, - "session_name": { - "type": "string", - "description": "Session name" - }, - "session_info": { - "type": "string", - "optional": true, - "description": "Textual information about the session" - }, - "uri": { - "type": "string", - "optional": true, - "description": "A pointer to additional information about the session" - }, - "email": { - "type": "string", - "optional": true, - "description": - "Email address for the person responsible for the conference" - }, - "phone_number": { - "type": "string", - "optional": true, - "description": - "Phone number for the person responsible for the conference" - }, - "connection_data": { - "type": "string", - "optional": true, - "description": "Connection data" - }, - "bandwidths": { + "attributes": { "type": "array", "optional": true, - "description": "Proposed bandwidths to be used by the session or media", + "description": "A list of attributes to extend SDP", "minItems": 1, "items": { - "type": "string" + "type": "string", + "description": "Attribute's name and value" } }, - "time_descriptions": { + "bandwidths": { "type": "array", - "description": "A list of time descriptions for a session", + "optional": true, + "description": "Proposed bandwidths to be used by the session or media", "minItems": 1, "items": { - "type": "object", - "optional": true, - "properties": { - "time": { - "type": "string", - "optional": true, - "description": "Start and stop times for a session" - }, - "repeat_time": { - "type": "string", - "optional": true, - "description": "Specify repeat times for a session" - } - }, - "additionalProperties": false + "type": "string" } }, - "timezone": { + "connection_data": { "type": "string", "optional": true, - "description": - "Timezone to specify adjustments for times and offsets from the base time" + "description": "Connection data" }, - "encryption_key": { + "email": { "type": "string", "optional": true, - "description": - "Field used to convey encryption keys if SDP is used over a secure channel" + "description": "Email address for the person responsible for the conference" }, - "attributes": { - "type": "array", + "encryption_key": { + "type": "string", "optional": true, - "description": "A list of attributes to extend SDP", - "minItems": 1, - "items": { - "type": "string", - "description": "Attribute's name and value" - } + "description": "Field used to convey encryption keys if SDP is used over a secure channel" }, "media_descriptions": { "type": "array", @@ -4340,17 +4211,17 @@ "minItems": 1, "items": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { - "media": { - "type": "string", - "description": "Media description" - }, - "media_info": { - "type": "string", + "attributes": { + "type": "array", + "description": "A list of attributes specified for a media description", "optional": true, - "description": - "Media information primarily intended for labelling media streams" + "minItems": 1, + "items": { + "type": "string", + "description": "Attribute's name and value" + } }, "bandwidths": { "type": "array", @@ -4369,145 +4240,99 @@ "encryption_key": { "type": "string", "optional": true, - "description": - "Field used to convey encryption keys if SDP is used over a secure channel" + "description": "Field used to convey encryption keys if SDP is used over a secure channel" }, - "attributes": { - "type": "array", - "description": - "A list of attributes specified for a media description", + "media": { + "type": "string", + "description": "Media description" + }, + "media_info": { + "type": "string", "optional": true, - "minItems": 1, - "items": { - "type": "string", - "description": "Attribute's name and value" - } + "description": "Media information primarily intended for labelling media streams" } }, - "additionalProperties": false + "optional": true } - } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "smb": { - "type": "object", - "optional": true, - "properties": { - "access": { - "type": "string" - }, - "accessed": { - "type": "integer" - }, - "changed": { - "type": "integer" - }, - "client_guid": { - "type": "string" - }, - "command": { - "type": "string" - }, - "created": { - "type": "integer" - }, - "dialect": { - "type": "string" - }, - "directory": { - "type": "string" - }, - "disposition": { - "type": "string" - }, - "filename": { - "type": "string" - }, - "fuid": { - "type": "string" - }, - "function": { - "type": "string" - }, - "id": { - "type": "integer" - }, - "level_of_interest": { - "type": "string" - }, - "max_read_size": { - "type": "integer" - }, - "max_write_size": { - "type": "integer" - }, - "modified": { - "type": "integer" - }, - "named_pipe": { - "type": "string" - }, - "rename": { - "type": "object", - "optional": true, - "properties": { - "from": { - "type": "string" }, - "to": { - "type": "string" - } - }, - "additionalProperties": false - }, - "request_done": { - "type": "boolean" - }, - "response_done": { - "type": "boolean" - }, - "server_guid": { - "type": "string" - }, - "session_id": { - "type": "integer" - }, - "set_info": { - "type": "object", - "optional": true, - "properties": { - "class": { - "type": "string" + "origin": { + "type": "string", + "description": "Owner of the session" + }, + "phone_number": { + "type": "string", + "optional": true, + "description": "Phone number for the person responsible for the conference" + }, + "session_info": { + "type": "string", + "optional": true, + "description": "Textual information about the session" + }, + "session_name": { + "type": "string", + "description": "Session name" + }, + "time_descriptions": { + "type": "array", + "description": "A list of time descriptions for a session", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "repeat_time": { + "type": "string", + "optional": true, + "description": "Specify repeat times for a session" + }, + "time": { + "type": "string", + "optional": true, + "description": "Start and stop times for a session" + } + }, + "optional": true + } + }, + "timezone": { + "type": "string", + "optional": true, + "description": "Timezone to specify adjustments for times and offsets from the base time" + }, + "uri": { + "type": "string", + "optional": true, + "description": "A pointer to additional information about the session" }, - "info_level": { - "type": "string" + "version": { + "type": "integer", + "description": "SDP protocol version" } }, - "additionalProperties": false - }, - "share": { - "type": "string" + "description": "SDP message body", + "optional": true }, - "share_type": { + "uri": { "type": "string" }, - "size": { - "type": "integer" - }, - "subcmd": { + "version": { "type": "string" - }, - "status": { + } + }, + "optional": true + }, + "smb": { + "type": "object", + "additionalProperties": false, + "properties": { + "access": { "type": "string" }, - "status_code": { - "type": "string" + "accessed": { + "type": "integer" }, - "tree_id": { + "changed": { "type": "integer" }, "client_dialects": { @@ -4517,28 +4342,28 @@ "type": "string" } }, + "client_guid": { + "type": "string" + }, + "command": { + "type": "string" + }, + "created": { + "type": "integer" + }, "dcerpc": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "call_id": { "type": "integer" }, - "opnum": { - "type": "integer" - }, - "request": { - "type": "string" - }, - "response": { - "type": "string" - }, "interfaces": { "type": "array", "minItems": 1, "items": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "ack_reason": { "type": "integer" @@ -4553,12 +4378,15 @@ "type": "string" } }, - "additionalProperties": false + "optional": true } }, + "opnum": { + "type": "integer" + }, "req": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "frag_cnt": { "type": "integer" @@ -4567,11 +4395,14 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "request": { + "type": "string" }, "res": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "frag_cnt": { "type": "integer" @@ -4580,14 +4411,38 @@ "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "response": { + "type": "string" } }, - "additionalProperties": false + "optional": true + }, + "dialect": { + "type": "string" + }, + "directory": { + "type": "string" + }, + "disposition": { + "type": "string" + }, + "filename": { + "type": "string" + }, + "fuid": { + "type": "string" + }, + "function": { + "type": "string" + }, + "id": { + "type": "integer" }, "kerberos": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "realm": { "type": "string" @@ -4600,11 +4455,26 @@ } } }, - "additionalProperties": false + "optional": true + }, + "level_of_interest": { + "type": "string" + }, + "max_read_size": { + "type": "integer" + }, + "max_write_size": { + "type": "integer" + }, + "modified": { + "type": "integer" + }, + "named_pipe": { + "type": "string" }, "ntlmssp": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "domain": { "type": "string" @@ -4623,11 +4493,24 @@ "type": "boolean" } }, - "additionalProperties": false + "optional": true + }, + "rename": { + "type": "object", + "additionalProperties": false, + "properties": { + "from": { + "type": "string" + }, + "to": { + "type": "string" + } + }, + "optional": true }, "request": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "native_lm": { "type": "string" @@ -4636,11 +4519,14 @@ "type": "string" } }, - "additionalProperties": false + "optional": true + }, + "request_done": { + "type": "boolean" }, "response": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "native_lm": { "type": "string" @@ -4649,11 +4535,17 @@ "type": "string" } }, - "additionalProperties": false + "optional": true + }, + "response_done": { + "type": "boolean" + }, + "server_guid": { + "type": "string" }, "service": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "request": { "type": "string" @@ -4662,14 +4554,51 @@ "type": "string" } }, - "additionalProperties": false + "optional": true + }, + "session_id": { + "type": "integer" + }, + "set_info": { + "type": "object", + "additionalProperties": false, + "properties": { + "class": { + "type": "string" + }, + "info_level": { + "type": "string" + } + }, + "optional": true + }, + "share": { + "type": "string" + }, + "share_type": { + "type": "string" + }, + "size": { + "type": "integer" + }, + "status": { + "type": "string" + }, + "status_code": { + "type": "string" + }, + "subcmd": { + "type": "string" + }, + "tree_id": { + "type": "integer" } }, - "additionalProperties": false + "optional": true }, "smtp": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "helo": { "type": "string" @@ -4685,11 +4614,11 @@ } } }, - "additionalProperties": false + "optional": true }, "snmp": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "community": { "type": "string" @@ -4700,34 +4629,39 @@ "usm": { "type": "string" }, - "version": { - "type": "integer" - }, "vars": { "type": "array", "minItems": 1, "items": { "type": "string" } + }, + "version": { + "type": "integer" } }, - "additionalProperties": false + "optional": true + }, + "spi": { + "type": "integer" + }, + "src_ip": { + "type": "string" + }, + "src_port": { + "type": "integer" }, "ssh": { "type": "object", - "optional": true, + "additionalProperties": false, "properties": { "client": { "type": "object", + "additionalProperties": false, "properties": { - "proto_version": { - "type": "string" - }, - "software_version": { - "type": "string" - }, "hassh": { "type": "object", + "additionalProperties": false, "properties": { "hash": { "type": "string" @@ -4735,23 +4669,23 @@ "string": { "type": "string" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "server": { - "type": "object", - "properties": { + } + }, "proto_version": { "type": "string" }, "software_version": { "type": "string" - }, + } + } + }, + "server": { + "type": "object", + "additionalProperties": false, + "properties": { "hassh": { "type": "object", + "additionalProperties": false, "properties": { "hash": { "type": "string" @@ -4759,53 +4693,33 @@ "string": { "type": "string" } - }, - "additionalProperties": false + } + }, + "proto_version": { + "type": "string" + }, + "software_version": { + "type": "string" } - }, - "additionalProperties": false + } } }, - "additionalProperties": false + "optional": true }, "stats": { "type": "object", - "optional": true, - "suricata": { - "keywords": false - }, + "additionalProperties": false, "properties": { - "uptime": { - "description": "Suricata engine's uptime", - "type": "integer" - }, - "capture": { - "type": "object", - "properties": { - "kernel_packets": { - "type": "integer" - }, - "kernel_drops": { - "type": "integer" - }, - "kernel_ifdrops": { - "type": "integer" - } - } - }, "app_layer": { "type": "object", + "additionalProperties": false, "properties": { - "expectations": { - "description": "Expectation (dynamic parallel flow) counter", - "type": "integer" - }, "error": { "type": "object", + "additionalProperties": false, "properties": { "bittorrent-dht": { - "description": - "Errors encountered parsing BitTorrent DHT protocol", + "description": "Errors encountered parsing BitTorrent DHT protocol", "$ref": "#/$defs/stats_applayer_error" }, "dcerpc_tcp": { @@ -4872,13 +4786,11 @@ "$ref": "#/$defs/stats_applayer_error" }, "krb5_tcp": { - "description": - "Errors encountered parsing Kerberos v5/TCP protocol", + "description": "Errors encountered parsing Kerberos v5/TCP protocol", "$ref": "#/$defs/stats_applayer_error" }, "krb5_udp": { - "description": - "Errors encountered parsing Kerberos v5/UDP protocol", + "description": "Errors encountered parsing Kerberos v5/UDP protocol", "$ref": "#/$defs/stats_applayer_error" }, "ldap_tcp": { @@ -4928,14 +4840,14 @@ "description": "Errors encountered parsing RFB protocol", "$ref": "#/$defs/stats_applayer_error" }, - "sip_udp": { - "description": "Errors encountered parsing SIP/UDP protocol", - "$ref": "#/$defs/stats_applayer_error" - }, "sip_tcp": { "description": "Errors encountered parsing SIP/TCP protocol", "$ref": "#/$defs/stats_applayer_error" }, + "sip_udp": { + "description": "Errors encountered parsing SIP/UDP protocol", + "$ref": "#/$defs/stats_applayer_error" + }, "smb": { "description": "Errors encountered parsing SMB protocol", "$ref": "#/$defs/stats_applayer_error" @@ -4967,655 +4879,457 @@ "websocket": { "$ref": "#/$defs/stats_applayer_error" } - }, - "additionalProperties": false + } + }, + "expectations": { + "type": "integer", + "description": "Expectation (dynamic parallel flow) counter" }, "flow": { "type": "object", + "additionalProperties": false, "properties": { "bittorrent-dht": { - "description": "Number of flows for BitTorrent DHT protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for BitTorrent DHT protocol" }, "dcerpc_tcp": { - "description": "Number of flows for DCERPC/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for DCERPC/TCP protocol" }, "dcerpc_udp": { - "description": "Number of flows for DCERPC/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for DCERPC/UDP protocol" }, "dhcp": { - "description": "Number of flows for DHCP", - "type": "integer" + "type": "integer", + "description": "Number of flows for DHCP" }, "dnp3": { - "description": "Number of flows for DNP3", - "type": "integer" + "type": "integer", + "description": "Number of flows for DNP3" }, "dns_tcp": { - "description": "Number of flows for DNS/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for DNS/TCP protocol" }, "dns_udp": { - "description": "Number of flows for DNS/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for DNS/UDP protocol" }, "doh2": { "type": "integer" }, "enip_tcp": { - "description": "Number of flows for ENIP/TCP", - "type": "integer" + "type": "integer", + "description": "Number of flows for ENIP/TCP" }, "enip_udp": { - "description": "Number of flows for ENIP/UDP", - "type": "integer" + "type": "integer", + "description": "Number of flows for ENIP/UDP" }, "failed_tcp": { - "description": "Number of failed flows for TCP", - "type": "integer" + "type": "integer", + "description": "Number of failed flows for TCP" }, "failed_udp": { - "description": "Number of failed flows for UDP", - "type": "integer" + "type": "integer", + "description": "Number of failed flows for UDP" }, "ftp": { - "description": "Number of flows for FTP", - "type": "integer" + "type": "integer", + "description": "Number of flows for FTP" }, "ftp-data": { - "description": "Number of flows for FTP data protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for FTP data protocol" }, "http": { - "description": "Number of flows for HTTP", - "type": "integer" + "type": "integer", + "description": "Number of flows for HTTP" }, "http2": { - "description": "Number of flows for HTTP/2", - "type": "integer" + "type": "integer", + "description": "Number of flows for HTTP/2" }, "ike": { - "description": "Number of flows for IKE protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for IKE protocol" }, "ikev2": { - "description": "Number of flows for IKE v2 protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for IKE v2 protocol" }, "imap": { - "description": "Number of flows for IMAP", - "type": "integer" + "type": "integer", + "description": "Number of flows for IMAP" }, "krb5_tcp": { - "description": "Number of flows for Kerberos v5/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for Kerberos v5/TCP protocol" }, "krb5_udp": { - "description": "Number of flows for Kerberos v5/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for Kerberos v5/UDP protocol" }, "ldap_tcp": { - "description": "Number of flows for LDAP/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for LDAP/TCP protocol" }, "ldap_udp": { - "description": "Number of flows LDAP/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows LDAP/UDP protocol" }, "modbus": { - "description": "Number of flows for Modbus protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for Modbus protocol" }, "mqtt": { - "description": "Number of flows for MQTT protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for MQTT protocol" }, "nfs_tcp": { - "description": "Number of flows for NFS/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for NFS/TCP protocol" }, "nfs_udp": { - "description": "Number of flows for NFS/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for NFS/UDP protocol" }, "ntp": { - "description": "Number of flows for NTP", - "type": "integer" + "type": "integer", + "description": "Number of flows for NTP" }, "pgsql": { - "description": "Number of flows for PostgreSQL protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for PostgreSQL protocol" }, "pop3": { "type": "integer" }, "quic": { - "description": "Number of flows for QUIC protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for QUIC protocol" }, "rdp": { - "description": "Number of flows for RDP", - "type": "integer" + "type": "integer", + "description": "Number of flows for RDP" }, "rfb": { - "description": "Number of flows for RFB protocol", - "type": "integer" - }, - "sip_udp": { - "description": "Number of flows for SIP/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for RFB protocol" }, "sip_tcp": { - "description": "Number of flows for SIP/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for SIP/TCP protocol" + }, + "sip_udp": { + "type": "integer", + "description": "Number of flows for SIP/UDP protocol" }, "smb": { - "description": "Number of flows for SMB protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for SMB protocol" }, "smtp": { - "description": "Number of flows for SMTP", - "type": "integer" + "type": "integer", + "description": "Number of flows for SMTP" }, "snmp": { - "description": "Number of flows for SNMP", - "type": "integer" + "type": "integer", + "description": "Number of flows for SNMP" }, "ssh": { - "description": "Number of flows for SSH protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for SSH protocol" }, "telnet": { - "description": "Number of flows for Telnet protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for Telnet protocol" }, "tftp": { - "description": "Number of flows for TFTP", - "type": "integer" + "type": "integer", + "description": "Number of flows for TFTP" }, "tls": { - "description": "Number of flows for TLS protocol", - "type": "integer" + "type": "integer", + "description": "Number of flows for TLS protocol" }, "websocket": { "type": "integer" } - }, - "additionalProperties": false + } }, "tx": { "type": "object", + "additionalProperties": false, "properties": { "bittorrent-dht": { - "description": - "Number of transactions for BitTorrent DHT protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for BitTorrent DHT protocol" }, "dcerpc_tcp": { - "description": "Number of transactions for DCERPC/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DCERPC/TCP protocol" }, "dcerpc_udp": { - "description": "Number of transactions for DCERPC/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DCERPC/UDP protocol" }, "dhcp": { - "description": "Number of transactions for DHCP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DHCP" }, "dnp3": { - "description": "Number of transactions for DNP3", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DNP3" }, "dns_tcp": { - "description": "Number of transactions for DNS/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DNS/TCP protocol" }, "dns_udp": { - "description": "Number of transactions for DNS/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for DNS/UDP protocol" }, "doh2": { "type": "integer" }, "enip_tcp": { - "description": "Number of transactions for ENIP/TCP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for ENIP/TCP" }, "enip_udp": { - "description": "Number of transactions for ENIP/UDP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for ENIP/UDP" }, "ftp": { - "description": "Number of transactions for FTP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for FTP" }, "ftp-data": { - "description": "Number of transactions for FTP data protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for FTP data protocol" }, "http": { - "description": "Number of transactions for HTTP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for HTTP" }, "http2": { - "description": "Number of transactions for HTTP/2", - "type": "integer" + "type": "integer", + "description": "Number of transactions for HTTP/2" }, "ike": { - "description": "Number of transactions for IKE protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for IKE protocol" }, "ikev2": { - "description": "Number of transactions for IKE v2 protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for IKE v2 protocol" }, "imap": { - "description": "Number of transactions for IMAP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for IMAP" }, "krb5_tcp": { - "description": - "Number of transactions for Kerberos v5/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for Kerberos v5/TCP protocol" }, "krb5_udp": { - "description": - "Number of transactions for Kerberos v5/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for Kerberos v5/UDP protocol" }, "ldap_tcp": { - "description": "Number of transactions for LDAP/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for LDAP/TCP protocol" }, "ldap_udp": { - "description": "Number of transactions for LDAP/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for LDAP/UDP protocol" }, "modbus": { - "description": "Number of transactions for Modbus protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for Modbus protocol" }, "mqtt": { - "description": "Number of transactions for MQTT protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for MQTT protocol" }, "nfs_tcp": { - "description": "Number of transactions for NFS/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for NFS/TCP protocol" }, "nfs_udp": { - "description": "Number of transactions for NFS/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for NFS/UDP protocol" }, "ntp": { - "description": "Number of transactions for NTP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for NTP" }, "pgsql": { - "description": "Number of transactions for PostgreSQL protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for PostgreSQL protocol" }, "pop3": { "type": "integer" }, "quic": { - "description": "Number of transactions for QUIC protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for QUIC protocol" }, "rdp": { - "description": "Number of transactions for RDP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for RDP" }, "rfb": { - "description": "Number of transactions for RFB protocol", - "type": "integer" - }, - "sip_udp": { - "description": "Number of transactions for SIP/UDP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for RFB protocol" }, "sip_tcp": { - "description": "Number of transactions for SIP/TCP protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for SIP/TCP protocol" + }, + "sip_udp": { + "type": "integer", + "description": "Number of transactions for SIP/UDP protocol" }, "smb": { - "description": "Number of transactions for SMB protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for SMB protocol" }, "smtp": { - "description": "Number of transactions for SMTP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for SMTP" }, "snmp": { - "description": "Number of transactions for SNMP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for SNMP" }, "ssh": { - "description": "Number of transactions for SSH protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for SSH protocol" }, "telnet": { - "description": "Number of transactions for Telnet protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for Telnet protocol" }, "tftp": { - "description": "Number of transactions for TFTP", - "type": "integer" + "type": "integer", + "description": "Number of transactions for TFTP" }, "tls": { - "description": "Number of transactions for TLS protocol", - "type": "integer" + "type": "integer", + "description": "Number of transactions for TLS protocol" }, "websocket": { "type": "integer" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "ips": { - "type": "object", - "properties": { - "accepted": { - "description": "Number of accepted packets", - "type": "integer" - }, - "blocked": { - "description": "Number of blocked packets", - "type": "integer" - }, - "rejected": { - "description": "Number of rejected packets", - "type": "integer" - }, - "replaced": { - "description": "Number of replaced packets", - "type": "integer" - }, - "drop_reason": { - "description": "Number of dropped packets, grouped by drop reason", - "type": "object", - "properties": { - "decode_error": { - "description": - "Number of packets dropped due to decoding errors", - "type": "integer" - }, - "defrag_error": { - "description": - "Number of packets dropped due to defragmentation errors", - "type": "integer" - }, - "defrag_memcap": { - "description": - "Number of packets dropped due to defrag memcap exception policy", - "type": "integer" - }, - "flow_memcap": { - "description": - "Number of packets dropped due to flow memcap exception policy", - "type": "integer" - }, - "flow_drop": { - "description": "Number of packets dropped due to dropped flows", - "type": "integer" - }, - "applayer_error": { - "description": - "Number of packets dropped due to app-layer error exception policy", - "type": "integer" - }, - "applayer_memcap": { - "description": - "Number of packets dropped due to applayer memcap", - "type": "integer" - }, - "rules": { - "description": "Number of packets dropped due to rule actions", - "type": "integer" - }, - "threshold_detection_filter": { - "description": - "Number of packets dropped due to threshold detection filter", - "type": "integer" - }, - "stream_error": { - "description": - "Number of packets dropped due to invalid TCP stream", - "type": "integer" - }, - "stream_memcap": { - "description": - "Number of packets dropped due to stream memcap exception policy", - "type": "integer" - }, - "stream_midstream": { - "description": - "Number of packets dropped due to stream midstream exception policy", - "type": "integer" - }, - "stream_reassembly": { - "description": - "Number of packets dropped due to stream reassembly exception policy", - "type": "integer" - }, - "stream_urgent": { - "description": - "Number of packets dropped due to TCP urgent flag", - "type": "integer" - }, - "nfq_error": { - "description": - "Number of packets dropped due to no NFQ verdict", - "type": "integer" - }, - "tunnel_packet_drop": { - "description": - "Number of packets dropped due to inner tunnel packet being dropped", - "type": "integer" - }, - "default_packet_policy": { - "description": - "Number of packets dropped due to default packet policy", - "type": "integer" - }, - "default_app_policy": { - "description": - "Number of packets dropped due to default app policy", - "type": "integer" - } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, - "decoder": { - "type": "object", - "properties": { - "avg_pkt_size": { - "type": "integer" - }, - "bytes": { - "type": "integer" - }, - "chdlc": { - "type": "integer" - }, - "erspan": { - "type": "integer" - }, - "esp": { - "type": "integer" - }, - "ethernet": { - "type": "integer" - }, - "arp": { - "type": "integer" - }, - "unknown_ethertype": { - "type": "integer" - }, - "geneve": { - "type": "integer" - }, - "gre": { - "type": "integer" - }, - "icmpv4": { - "type": "integer" - }, - "icmpv6": { - "type": "integer" - }, - "ieee8021ah": { - "type": "integer" - }, - "invalid": { - "type": "integer" - }, - "ipv4": { - "type": "integer" - }, - "ipv4_in_ipv6": { - "type": "integer" - }, - "ipv6": { - "type": "integer" - }, - "ipv6_in_ipv6": { - "type": "integer" - }, - "max_mac_addrs_dst": { - "type": "integer" - }, - "max_mac_addrs_src": { - "type": "integer" - }, - "max_pkt_size": { - "type": "integer" - }, - "mpls": { - "type": "integer" - }, - "nsh": { - "type": "integer" - }, - "null": { - "type": "integer" - }, - "pkts": { - "type": "integer" - }, - "ppp": { - "type": "integer" - }, - "pppoe": { - "type": "integer" - }, - "raw": { - "type": "integer" - }, - "sctp": { - "type": "integer" - }, - "sll": { + "capture": { + "type": "object", + "properties": { + "kernel_drops": { "type": "integer" }, - "tcp": { + "kernel_ifdrops": { "type": "integer" }, - "teredo": { + "kernel_packets": { "type": "integer" - }, - "too_many_layers": { + } + } + }, + "decoder": { + "type": "object", + "additionalProperties": false, + "properties": { + "arp": { "type": "integer" }, - "udp": { + "avg_pkt_size": { "type": "integer" }, - "vlan": { + "bytes": { "type": "integer" }, - "vlan_qinq": { + "chdlc": { "type": "integer" }, - "vlan_qinqinq": { + "erspan": { "type": "integer" }, - "vntag": { + "esp": { "type": "integer" }, - "vxlan": { + "ethernet": { "type": "integer" }, "event": { "type": "object", + "additionalProperties": false, "properties": { "afpacket": { "type": "object", + "additionalProperties": false, "properties": { "trunc_pkt": { - "description": - "Number of packets truncated by AF_PACKET", - "type": "integer" + "type": "integer", + "description": "Number of packets truncated by AF_PACKET" } - }, - "additionalProperties": false + } }, "arp": { "type": "object", + "additionalProperties": false, "properties": { - "pkt_too_small": { + "invalid_hardware_size": { "type": "integer" }, - "unsupported_hardware": { + "invalid_protocol_size": { "type": "integer" }, - "unsupported_protocol": { + "pkt_too_small": { "type": "integer" }, - "unsupported_pkt": { + "unsupported_hardware": { "type": "integer" }, - "invalid_hardware_size": { + "unsupported_opcode": { "type": "integer" }, - "invalid_protocol_size": { + "unsupported_pkt": { "type": "integer" }, - "unsupported_opcode": { + "unsupported_protocol": { "type": "integer" } - }, - "additionalProperties": false + } }, "chdlc": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "dce": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "erspan": { "type": "object", + "additionalProperties": false, "properties": { "header_too_small": { "type": "integer" @@ -5626,20 +5340,20 @@ "unsupported_version": { "type": "integer" } - }, - "additionalProperties": false + } }, "esp": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "ethernet": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" @@ -5647,20 +5361,20 @@ "unknown_ethertype": { "type": "integer" } - }, - "additionalProperties": false + } }, "geneve": { "type": "object", + "additionalProperties": false, "properties": { "unknown_payload_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "gre": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" @@ -5707,11 +5421,11 @@ "wrong_version": { "type": "integer" } - }, - "additionalProperties": false + } }, "icmpv4": { "type": "object", + "additionalProperties": false, "properties": { "ipv4_trunc_pkt": { "type": "integer" @@ -5728,11 +5442,11 @@ "unknown_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "icmpv6": { "type": "object", + "additionalProperties": false, "properties": { "experimentation_type": { "type": "integer" @@ -5758,29 +5472,29 @@ "unknown_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "ieee8021ah": { "type": "object", + "additionalProperties": false, "properties": { "header_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "ipraw": { "type": "object", + "additionalProperties": false, "properties": { "invalid_ip_version": { "type": "integer" } - }, - "additionalProperties": false + } }, "ipv4": { "type": "object", + "additionalProperties": false, "properties": { "frag_ignored": { "type": "integer" @@ -5830,11 +5544,11 @@ "wrong_ip_version": { "type": "integer" } - }, - "additionalProperties": false + } }, "ipv6": { "type": "object", + "additionalProperties": false, "properties": { "data_after_none_header": { "type": "integer" @@ -5929,11 +5643,11 @@ "zero_len_padn": { "type": "integer" } - }, - "additionalProperties": false + } }, "ltnull": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" @@ -5941,11 +5655,11 @@ "unsupported_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "mpls": { "type": "object", + "additionalProperties": false, "properties": { "bad_label_implicit_null": { "type": "integer" @@ -5965,11 +5679,11 @@ "unknown_payload_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "nsh": { "type": "object", + "additionalProperties": false, "properties": { "bad_header_length": { "type": "integer" @@ -5989,11 +5703,11 @@ "unsupported_version": { "type": "integer" } - }, - "additionalProperties": false + } }, "ppp": { "type": "object", + "additionalProperties": false, "properties": { "ip4_pkt_too_small": { "type": "integer" @@ -6013,11 +5727,11 @@ "wrong_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "pppoe": { "type": "object", + "additionalProperties": false, "properties": { "malformed_tags": { "type": "integer" @@ -6028,29 +5742,29 @@ "wrong_code": { "type": "integer" } - }, - "additionalProperties": false + } }, "sctp": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "sll": { "type": "object", + "additionalProperties": false, "properties": { "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "tcp": { "type": "object", + "additionalProperties": false, "properties": { "hlen_too_small": { "type": "integer" @@ -6067,11 +5781,11 @@ "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "udp": { "type": "object", + "additionalProperties": false, "properties": { "hlen_invalid": { "type": "integer" @@ -6079,17 +5793,17 @@ "hlen_too_small": { "type": "integer" }, - "pkt_too_small": { + "len_invalid": { "type": "integer" }, - "len_invalid": { + "pkt_too_small": { "type": "integer" } - }, - "additionalProperties": false + } }, "vlan": { "type": "object", + "additionalProperties": false, "properties": { "header_too_small": { "type": "integer" @@ -6100,11 +5814,11 @@ "unknown_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "vntag": { "type": "object", + "additionalProperties": false, "properties": { "header_too_small": { "type": "integer" @@ -6112,53 +5826,124 @@ "unknown_type": { "type": "integer" } - }, - "additionalProperties": false + } }, "vxlan": { "type": "object", + "additionalProperties": false, "properties": { "unknown_payload_type": { "type": "integer" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "defrag": { - "type": "object", - "properties": { - "tracker_soft_reuse": { - "type": "integer", - "description": - "Finished tracker re-used from hash table before being moved to spare pool" + } }, - "tracker_hard_reuse": { - "type": "integer", - "description": - "Active tracker force closed before completion and reused for new tracker" + "geneve": { + "type": "integer" }, - "max_trackers_reached": { - "type": "integer", - "description": - "How many times a packet wasn't reassembled due to max-trackers limit being reached" + "gre": { + "type": "integer" }, - "max_frags_reached": { - "type": "integer", - "description": - "How many times a fragment wasn't stored due to max-frags limit being reached" + "icmpv4": { + "type": "integer" }, - "memuse": { - "type": "integer", - "description": "Current memory use." + "icmpv6": { + "type": "integer" + }, + "ieee8021ah": { + "type": "integer" + }, + "invalid": { + "type": "integer" + }, + "ipv4": { + "type": "integer" + }, + "ipv4_in_ipv6": { + "type": "integer" + }, + "ipv6": { + "type": "integer" + }, + "ipv6_in_ipv6": { + "type": "integer" + }, + "max_mac_addrs_dst": { + "type": "integer" + }, + "max_mac_addrs_src": { + "type": "integer" + }, + "max_pkt_size": { + "type": "integer" + }, + "mpls": { + "type": "integer" + }, + "nsh": { + "type": "integer" + }, + "null": { + "type": "integer" + }, + "pkts": { + "type": "integer" + }, + "ppp": { + "type": "integer" + }, + "pppoe": { + "type": "integer" + }, + "raw": { + "type": "integer" + }, + "sctp": { + "type": "integer" + }, + "sll": { + "type": "integer" + }, + "tcp": { + "type": "integer" + }, + "teredo": { + "type": "integer" + }, + "too_many_layers": { + "type": "integer" + }, + "udp": { + "type": "integer" + }, + "unknown_ethertype": { + "type": "integer" + }, + "vlan": { + "type": "integer" + }, + "vlan_qinq": { + "type": "integer" }, + "vlan_qinqinq": { + "type": "integer" + }, + "vntag": { + "type": "integer" + }, + "vxlan": { + "type": "integer" + } + } + }, + "defrag": { + "type": "object", + "additionalProperties": false, + "properties": { "ipv4": { "type": "object", + "additionalProperties": false, "properties": { "fragments": { "type": "integer" @@ -6169,11 +5954,11 @@ "timeouts": { "type": "integer" } - }, - "additionalProperties": false + } }, "ipv6": { "type": "object", + "additionalProperties": false, "properties": { "fragments": { "type": "integer" @@ -6184,32 +5969,51 @@ "timeouts": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "max_frags_reached": { + "type": "integer", + "description": "How many times a fragment wasn't stored due to max-frags limit being reached" + }, + "max_trackers_reached": { + "type": "integer", + "description": "How many times a packet wasn't reassembled due to max-trackers limit being reached" + }, + "memuse": { + "type": "integer", + "description": "Current memory use." }, "mgr": { "type": "object", + "additionalProperties": false, "properties": { "tracker_timeout": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "tracker_hard_reuse": { + "type": "integer", + "description": "Active tracker force closed before completion and reused for new tracker" + }, + "tracker_soft_reuse": { + "type": "integer", + "description": "Finished tracker re-used from hash table before being moved to spare pool" }, "wrk": { "type": "object", + "additionalProperties": false, "properties": { "tracker_timeout": { "type": "integer" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "detect": { "type": "object", + "additionalProperties": false, "properties": { "alert": { "type": "integer" @@ -6220,47 +6024,12 @@ "alerts_suppressed": { "type": "integer" }, - "lua": { - "type": "object", - "properties": { - "blocked_function_errors": { - "description": - "Counter for Lua scripts failing due to blocked functions being called", - "type": "integer" - }, - "instruction_limit_errors": { - "description": - "Count of Lua rules exceeding the instruction limit", - "type": "integer" - }, - "memory_limit_errors": { - "description": "Count of Lua rules exceeding the memory limit", - "type": "integer" - }, - "errors": { - "description": "Errors encountered while running Lua scripts", - "type": "integer" - } - }, - "additionalProperties": false - }, - "mpm_list": { - "type": "integer" - }, - "nonmpm_list": { - "type": "integer" - }, - "fnonmpm_list": { - "type": "integer" - }, - "match_list": { - "type": "integer" - }, "engines": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "id": { "type": "integer" @@ -6268,21 +6037,53 @@ "last_reload": { "type": "string" }, - "rules_loaded": { + "rules_failed": { "type": "integer" }, - "rules_failed": { + "rules_loaded": { "type": "integer" }, "rules_skipped": { "type": "integer" } + } + } + }, + "fnonmpm_list": { + "type": "integer" + }, + "lua": { + "type": "object", + "additionalProperties": false, + "properties": { + "blocked_function_errors": { + "type": "integer", + "description": "Counter for Lua scripts failing due to blocked functions being called" + }, + "errors": { + "type": "integer", + "description": "Errors encountered while running Lua scripts" }, - "additionalProperties": false + "instruction_limit_errors": { + "type": "integer", + "description": "Count of Lua rules exceeding the instruction limit" + }, + "memory_limit_errors": { + "type": "integer", + "description": "Count of Lua rules exceeding the memory limit" + } } + }, + "match_list": { + "type": "integer" + }, + "mpm_list": { + "type": "integer" + }, + "nonmpm_list": { + "type": "integer" } - }, - "additionalProperties": false + } }, "exception_policy": { "type": "object", @@ -6290,42 +6091,36 @@ "app_layer": { "type": "object", "error": { - "description": - "Consolidated stats on how many times app-layer error exception policy was applied, and which one", + "description": "Consolidated stats on how many times app-layer error exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" } }, "defrag": { "type": "object", "memcap": { - "description": - "How many times defrag memcap exception policy was applied, and which one", + "description": "How many times defrag memcap exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" } }, "flow": { "type": "object", "memcap": { - "description": - "How many times flow memcap exception policy was applied, and which one", + "description": "How many times flow memcap exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" } }, "tcp": { "type": "object", "midstream": { - "description": - "How many times midstream exception policy was applied, and which one", + "description": "How many times midstream exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" }, "ssn_memcap": { - "description": - "How many times session memcap exception policy was applied, and which one", + "description": "How many times session memcap exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" }, "reassembly": { - "description": - "How many times reassembly memcap exception policy was applied, and which one", + "description": "How many times reassembly memcap exception policy was applied, and which one", "$ref": "#/$defs/exceptionPolicy" } } @@ -6333,6 +6128,7 @@ }, "file_store": { "type": "object", + "additionalProperties": false, "properties": { "fs_errors": { "type": "integer" @@ -6343,124 +6139,67 @@ "open_files_max_hit": { "type": "integer" } - }, - "additionalProperties": false + } }, "flow": { "type": "object", + "additionalProperties": false, "properties": { "active": { - "description": "Number of currently active flows", - "type": "integer" + "type": "integer", + "description": "Number of currently active flows" + }, + "elephant": { + "type": "integer", + "description": "Total number of elephant flows" }, "emerg_mode_entered": { - "description": "Number of times emergency mode was entered", - "type": "integer" + "type": "integer", + "description": "Number of times emergency mode was entered" }, "emerg_mode_over": { - "description": "Number of times recovery was made from emergency mode", - "type": "integer" - }, - "get_used": { - "description": - "Number of reused flows from the hash table in case memcap was reached and spare pool was empty", - "type": "integer" - }, - "get_used_eval": { - "description": - "Number of attempts at getting a flow directly from the hash", - "type": "integer" - }, - "get_used_eval_busy": { - "description": - "Number of times a flow was found in the hash but the lock for hash bucket could not be obtained", - "type": "integer" - }, - "get_used_eval_reject": { - "description": - "Number of flows that were evaluated but rejected from reuse as they were still alive/active", - "type": "integer" - }, - "get_used_failed": { - "description": - "Number of times retrieval of flow from hash was attempted but was unsuccessful", - "type": "integer" - }, - "icmpv4": { - "description": "Number of ICMPv4 flows", - "type": "integer" - }, - "icmpv6": { - "description": "Number of ICMPv6 flows", - "type": "integer" - }, - "memcap": { - "description": "Number of times memcap was reached for flows", - "type": "integer" - }, - "memuse": { - "description": "Memory currently in use by the flows", - "type": "integer" - }, - "spare": { - "description": "Number of flows in the spare pool", - "type": "integer" - }, - "tcp": { - "description": "Number of TCP flows", - "type": "integer" - }, - "tcp_reuse": { - "description": - "Number of TCP flows that were reused as they seemed to share the same flow tuple", - "type": "integer" - }, - "total": { - "description": "Total number of flows", - "type": "integer" - }, - "elephant": { - "description": "Total number of elephant flows", - "type": "integer" - }, - "udp": { - "description": "Number of UDP flows", - "type": "integer" + "type": "integer", + "description": "Number of times recovery was made from emergency mode" }, "end": { "type": "object", + "additionalProperties": false, "properties": { "state": { "type": "object", + "additionalProperties": false, "properties": { - "new": { + "capture_bypassed": { "type": "integer" }, - "established": { + "closed": { "type": "integer" }, - "closed": { + "established": { "type": "integer" }, "local_bypassed": { "type": "integer" }, - "capture_bypassed": { + "new": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "tcp_liberal": { + "type": "integer" }, "tcp_state": { "type": "object", + "additionalProperties": false, "properties": { - "none": { + "close_wait": { "type": "integer" }, - "syn_sent": { + "closed": { "type": "integer" }, - "syn_recv": { + "closing": { "type": "integer" }, "established": { @@ -6472,92 +6211,140 @@ "fin_wait2": { "type": "integer" }, - "time_wait": { + "last_ack": { "type": "integer" }, - "last_ack": { + "none": { "type": "integer" }, - "close_wait": { + "syn_recv": { "type": "integer" }, - "closing": { + "syn_sent": { "type": "integer" }, - "closed": { + "time_wait": { "type": "integer" } - }, - "additionalProperties": false - }, - "tcp_liberal": { - "type": "integer" + } } - }, - "additionalProperties": false + } + }, + "get_used": { + "type": "integer", + "description": "Number of reused flows from the hash table in case memcap was reached and spare pool was empty" + }, + "get_used_eval": { + "type": "integer", + "description": "Number of attempts at getting a flow directly from the hash" + }, + "get_used_eval_busy": { + "type": "integer", + "description": "Number of times a flow was found in the hash but the lock for hash bucket could not be obtained" + }, + "get_used_eval_reject": { + "type": "integer", + "description": "Number of flows that were evaluated but rejected from reuse as they were still alive/active" + }, + "get_used_failed": { + "type": "integer", + "description": "Number of times retrieval of flow from hash was attempted but was unsuccessful" + }, + "icmpv4": { + "type": "integer", + "description": "Number of ICMPv4 flows" + }, + "icmpv6": { + "type": "integer", + "description": "Number of ICMPv6 flows" + }, + "memcap": { + "type": "integer", + "description": "Number of times memcap was reached for flows" + }, + "memuse": { + "type": "integer", + "description": "Memory currently in use by the flows" }, "mgr": { "type": "object", + "additionalProperties": false, "properties": { "flows_checked": { - "description": - "number of flows checked for timeout in the last pass", - "type": "integer" + "type": "integer", + "description": "number of flows checked for timeout in the last pass" }, "flows_evicted": { - "description": "number of flows that were evicted", - "type": "integer" + "type": "integer", + "description": "number of flows that were evicted" }, "flows_evicted_needs_work": { - "description": - "number of TCP flows that were returned to the workers in case reassembly, detection, logging still needs work", - "type": "integer" + "type": "integer", + "description": "number of TCP flows that were returned to the workers in case reassembly, detection, logging still needs work" }, "flows_notimeout": { - "description": "number of flows that did not time out", - "type": "integer" + "type": "integer", + "description": "number of flows that did not time out" }, "flows_timeout": { - "description": "number of flows that reached the time out", - "type": "integer" + "type": "integer", + "description": "number of flows that reached the time out" }, "full_hash_pass": { - "description": - "number of times a full pass of the hash table was done", - "type": "integer" + "type": "integer", + "description": "number of times a full pass of the hash table was done" }, "rows_maxlen": { - "description": "size of the biggest row in the hash table", - "type": "integer" + "type": "integer", + "description": "size of the biggest row in the hash table" }, "rows_per_sec": { - "description": - "number of rows to be scanned every second by a worker", - "type": "integer" + "type": "integer", + "description": "number of rows to be scanned every second by a worker" } - }, - "additionalProperties": false + } }, "recycler": { "type": "object", + "additionalProperties": false, "properties": { - "recycled": { - "description": "number of recycled flows", - "type": "integer" - }, "queue_avg": { - "description": "average number of recycled flows per queue", - "type": "integer" + "type": "integer", + "description": "average number of recycled flows per queue" }, "queue_max": { - "description": "maximum number of recycled flows per queue", - "type": "integer" + "type": "integer", + "description": "maximum number of recycled flows per queue" + }, + "recycled": { + "type": "integer", + "description": "number of recycled flows" } - }, - "additionalProperties": false + } + }, + "spare": { + "type": "integer", + "description": "Number of flows in the spare pool" + }, + "tcp": { + "type": "integer", + "description": "Number of TCP flows" + }, + "tcp_reuse": { + "type": "integer", + "description": "Number of TCP flows that were reused as they seemed to share the same flow tuple" + }, + "total": { + "type": "integer", + "description": "Total number of flows" + }, + "udp": { + "type": "integer", + "description": "Number of UDP flows" }, "wrk": { "type": "object", + "additionalProperties": false, "properties": { "flows_evicted": { "type": "integer" @@ -6586,14 +6373,13 @@ "spare_sync_incomplete": { "type": "integer" } - }, - "additionalProperties": false + } } - }, - "additionalProperties": false + } }, "flow_bypassed": { "type": "object", + "additionalProperties": false, "properties": { "bytes": { "type": "integer" @@ -6616,11 +6402,11 @@ "pkts": { "type": "integer" } - }, - "additionalProperties": false + } }, "flow_mgr": { "type": "object", + "additionalProperties": false, "properties": { "bypassed_pruned": { "type": "integer" @@ -6661,26 +6447,23 @@ "rows_skipped": { "type": "integer" } - }, - "additionalProperties": false + } }, - "memcap": { + "ftp": { "type": "object", + "additionalProperties": false, "properties": { - "pressure": { - "description": - "Percentage of memcaps used by flow, stream, stream-reassembly and app-layer-http", + "memcap": { "type": "integer" }, - "pressure_max": { - "description": "Maximum pressure seen by the engine", + "memuse": { "type": "integer" } - }, - "additionalProperties": false + } }, - "ftp": { + "host": { "type": "object", + "additionalProperties": false, "properties": { "memcap": { "type": "integer" @@ -6688,20 +6471,15 @@ "memuse": { "type": "integer" } - }, - "additionalProperties": false + } }, "http": { "type": "object", + "additionalProperties": false, "properties": { - "memcap": { - "type": "integer" - }, - "memuse": { - "type": "integer" - }, "byterange": { "type": "object", + "additionalProperties": false, "properties": { "memcap": { "type": "integer" @@ -6709,26 +6487,19 @@ "memuse": { "type": "integer" } - }, - "additionalProperties": false - } - }, - "additionalProperties": false - }, - "host": { - "type": "object", - "properties": { + } + }, "memcap": { "type": "integer" }, "memuse": { "type": "integer" } - }, - "additionalProperties": false + } }, "ippair": { "type": "object", + "additionalProperties": false, "properties": { "memcap": { "type": "integer" @@ -6736,25 +6507,140 @@ "memuse": { "type": "integer" } - }, - "additionalProperties": false + } }, - "pcap_log": { + "ips": { "type": "object", + "additionalProperties": false, "properties": { - "written": { - "description": "Number of packets written", - "type": "integer" + "accepted": { + "type": "integer", + "description": "Number of accepted packets" + }, + "blocked": { + "type": "integer", + "description": "Number of blocked packets" + }, + "drop_reason": { + "type": "object", + "additionalProperties": false, + "properties": { + "applayer_error": { + "type": "integer", + "description": "Number of packets dropped due to app-layer error exception policy" + }, + "applayer_memcap": { + "type": "integer", + "description": "Number of packets dropped due to applayer memcap" + }, + "decode_error": { + "type": "integer", + "description": "Number of packets dropped due to decoding errors" + }, + "default_app_policy": { + "type": "integer", + "description": "Number of packets dropped due to default app policy" + }, + "default_packet_policy": { + "type": "integer", + "description": "Number of packets dropped due to default packet policy" + }, + "defrag_error": { + "type": "integer", + "description": "Number of packets dropped due to defragmentation errors" + }, + "defrag_memcap": { + "type": "integer", + "description": "Number of packets dropped due to defrag memcap exception policy" + }, + "flow_drop": { + "type": "integer", + "description": "Number of packets dropped due to dropped flows" + }, + "flow_memcap": { + "type": "integer", + "description": "Number of packets dropped due to flow memcap exception policy" + }, + "nfq_error": { + "type": "integer", + "description": "Number of packets dropped due to no NFQ verdict" + }, + "rules": { + "type": "integer", + "description": "Number of packets dropped due to rule actions" + }, + "stream_error": { + "type": "integer", + "description": "Number of packets dropped due to invalid TCP stream" + }, + "stream_memcap": { + "type": "integer", + "description": "Number of packets dropped due to stream memcap exception policy" + }, + "stream_midstream": { + "type": "integer", + "description": "Number of packets dropped due to stream midstream exception policy" + }, + "stream_reassembly": { + "type": "integer", + "description": "Number of packets dropped due to stream reassembly exception policy" + }, + "stream_urgent": { + "type": "integer", + "description": "Number of packets dropped due to TCP urgent flag" + }, + "threshold_detection_filter": { + "type": "integer", + "description": "Number of packets dropped due to threshold detection filter" + }, + "tunnel_packet_drop": { + "type": "integer", + "description": "Number of packets dropped due to inner tunnel packet being dropped" + } + }, + "description": "Number of dropped packets, grouped by drop reason" + }, + "rejected": { + "type": "integer", + "description": "Number of rejected packets" + }, + "replaced": { + "type": "integer", + "description": "Number of replaced packets" + } + } + }, + "memcap": { + "type": "object", + "additionalProperties": false, + "properties": { + "pressure": { + "type": "integer", + "description": "Percentage of memcaps used by flow, stream, stream-reassembly and app-layer-http" }, + "pressure_max": { + "type": "integer", + "description": "Maximum pressure seen by the engine" + } + } + }, + "pcap_log": { + "type": "object", + "additionalProperties": false, + "properties": { "filtered_bpf": { - "description": "Number of packets filtered out by bpf (not written)", - "type": "integer" + "type": "integer", + "description": "Number of packets filtered out by bpf (not written)" + }, + "written": { + "type": "integer", + "description": "Number of packets written" } - }, - "additionalProperties": false + } }, "tcp": { "type": "object", + "additionalProperties": false, "properties": { "ack_unseen_data": { "type": "integer" @@ -6804,15 +6690,15 @@ "rst": { "type": "integer" }, - "segment_memcap_drop": { - "type": "integer" - }, "segment_from_cache": { "type": "integer" }, "segment_from_pool": { "type": "integer" }, + "segment_memcap_drop": { + "type": "integer" + }, "sessions": { "type": "integer" }, @@ -6835,18 +6721,36 @@ "type": "integer" }, "urg": { - "description": "Number of TCP packets with the urgent flag set", - "type": "integer" + "type": "integer", + "description": "Number of TCP packets with the urgent flag set" }, "urgent_oob_data": { - "description": "Number of OOB bytes tracked in TCP urgent handling", - "type": "integer" + "type": "integer", + "description": "Number of OOB bytes tracked in TCP urgent handling" } - }, - "additionalProperties": false + } + }, + "uptime": { + "type": "integer", + "description": "Suricata engine's uptime" } }, - "additionalProperties": false + "optional": true, + "suricata": { + "keywords": false + } + }, + "stream": { + "type": "integer" + }, + "stream_tcp": { + "type": "object" + }, + "suricata_version": { + "type": "string" + }, + "tc_progress": { + "type": "string" }, "tcp": { "type": "object", @@ -6882,9 +6786,8 @@ "type": "integer" }, "tc_urgent_oob_data": { - "description": - "Number of Out-of-Band bytes sent by server using TCP urgent packets", - "type": "integer" + "type": "integer", + "description": "Number of Out-of-Band bytes sent by server using TCP urgent packets" }, "tcp_flags": { "type": "string" @@ -6902,18 +6805,17 @@ "type": "integer" }, "ts_urgent_oob_data": { - "description": - "Number of Out-of-Band bytes sent by client using TCP urgent packets", - "type": "integer" + "type": "integer", + "description": "Number of Out-of-Band bytes sent by client using TCP urgent packets" }, "urg": { "type": "boolean" } - }, - "additionalProperties": true + } }, "template": { "type": "object", + "additionalProperties": false, "properties": { "request": { "type": "string" @@ -6921,11 +6823,11 @@ "response": { "type": "string" } - }, - "additionalProperties": false + } }, "tftp": { "type": "object", + "additionalProperties": false, "properties": { "file": { "type": "string" @@ -6936,11 +6838,15 @@ "packet": { "type": "string" } - }, - "additionalProperties": false + } + }, + "timestamp": { + "type": "string", + "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+[+\\-]\\d+$" }, "tls": { "type": "object", + "additionalProperties": false, "properties": { "certificate": { "type": "string", @@ -6965,6 +6871,7 @@ }, "client": { "type": "object", + "additionalProperties": false, "properties": { "certificate": { "type": "string", @@ -6997,24 +6904,12 @@ } }, "issuerdn": { + "type": "string", "suricata": { "keywords": [ "tls.cert_issuer", "tls.issuerdn" ] - }, - "type": "string" - }, - "subjectaltname": { - "description": "TLS Subject Alternative Name field", - "type": "array", - "suricata": { - "keywords": [ - "tls.subjectaltname" - ] - }, - "items": { - "type": "string" } }, "notafter": { @@ -7053,13 +6948,24 @@ "tls.subject" ] } + }, + "subjectaltname": { + "type": "array", + "description": "TLS Subject Alternative Name field", + "suricata": { + "keywords": [ + "tls.subjectaltname" + ] + }, + "items": { + "type": "string" + } } - }, - "additionalProperties": false + } }, "client_alpns": { - "description": "TLS client ALPN field(s)", "type": "array", + "description": "TLS client ALPN field(s)", "suricata": { "keywords": [ "tls.alpn" @@ -7072,10 +6978,6 @@ "client_handshake": { "type": "object", "properties": { - "version": { - "description": "TLS version in client hello", - "type": "string" - }, "ciphers": { "description": "TLS client cipher(s)", "type": "array", @@ -7099,73 +7001,84 @@ "items": { "type": "integer" } + }, + "version": { + "description": "TLS version in client hello", + "type": "string" } } }, - "server_handshake": { + "fingerprint": { + "type": "string", + "suricata": { + "keywords": [ + "tls.cert_fingerprint", + "tls.fingerprint" + ] + } + }, + "from_proto": { + "type": "string" + }, + "issuerdn": { + "type": "string", + "suricata": { + "keywords": [ + "tls.cert_issuer", + "tls.issuerdn" + ] + } + }, + "ja3": { "type": "object", + "additionalProperties": false, "properties": { - "version": { - "description": "TLS version in server hello", - "type": "string" + "hash": { + "type": "string", + "suricata": { + "keywords": [ + "ja3.hash" + ] + } }, - "cipher": { - "description": "TLS server's chosen cipher", - "type": "integer" + "string": { + "type": "string", + "suricata": { + "keywords": [ + "ja3s.string" + ] + } + } + } + }, + "ja3s": { + "type": "object", + "additionalProperties": false, + "properties": { + "hash": { + "type": "string", + "suricata": { + "keywords": [ + "ja3s.hash" + ] + } }, - "exts": { - "description": "TLS server extension(s)", - "type": "array", - "minItems": 1, - "items": { - "type": "integer" + "string": { + "type": "string", + "suricata": { + "keywords": [ + "ja3s.string" + ] } } } }, - "server_alpns": { - "description": "TLS server ALPN field(s)", - "type": "array", - "suricata": { - "keywords": [ - "tls.alpn" - ] - }, - "items": { - "type": "string" - } - }, - "fingerprint": { + "ja4": { "type": "string", "suricata": { "keywords": [ - "tls.cert_fingerprint", - "tls.fingerprint" - ] - } - }, - "from_proto": { - "type": "string" - }, - "issuerdn": { - "suricata": { - "keywords": [ - "tls.cert_issuer", - "tls.issuerdn" - ] - }, - "type": "string" - }, - "subjectaltname": { - "description": "TLS Subject Alternative Name field", - "type": "array", - "suricata": { - "keywords": [ - "tls.subjectaltname" + "ja4.hash" ] - }, - "items": { - "type": "string" } }, "notafter": { @@ -7196,6 +7109,39 @@ ] } }, + "server_alpns": { + "type": "array", + "description": "TLS server ALPN field(s)", + "suricata": { + "keywords": [ + "tls.alpn" + ] + }, + "items": { + "type": "string" + } + }, + "server_handshake": { + "type": "object", + "properties": { + "cipher": { + "description": "TLS server's chosen cipher", + "type": "integer" + }, + "exts": { + "description": "TLS server extension(s)", + "type": "array", + "minItems": 1, + "items": { + "type": "integer" + } + }, + "version": { + "description": "TLS version in server hello", + "type": "string" + } + } + }, "session_resumed": { "type": "boolean" }, @@ -7216,71 +7162,31 @@ ] } }, - "version": { - "type": "string", + "subjectaltname": { + "type": "array", + "description": "TLS Subject Alternative Name field", "suricata": { "keywords": [ - "tls.version" + "tls.subjectaltname" ] - } - }, - "ja3": { - "type": "object", - "properties": { - "hash": { - "suricata": { - "keywords": [ - "ja3.hash" - ] - }, - "type": "string" - }, - "string": { - "suricata": { - "keywords": [ - "ja3s.string" - ] - }, - "type": "string" - } - }, - "additionalProperties": false - }, - "ja3s": { - "type": "object", - "properties": { - "hash": { - "suricata": { - "keywords": [ - "ja3s.hash" - ] - }, - "type": "string" - }, - "string": { - "suricata": { - "keywords": [ - "ja3s.string" - ] - }, - "type": "string" - } }, - "additionalProperties": false + "items": { + "type": "string" + } }, - "ja4": { + "version": { + "type": "string", "suricata": { "keywords": [ - "ja4.hash" + "tls.version" ] - }, - "type": "string" + } } - }, - "additionalProperties": false + } }, "traffic": { "type": "object", + "additionalProperties": false, "properties": { "id": { "type": "array", @@ -7296,11 +7202,14 @@ "type": "string" } } - }, - "additionalProperties": false + } + }, + "ts_progress": { + "type": "string" }, "tunnel": { "type": "object", + "additionalProperties": false, "properties": { "depth": { "type": "integer" @@ -7326,11 +7235,28 @@ "src_port": { "type": "integer" } - }, - "additionalProperties": false + } + }, + "tx_guessed": { + "type": "boolean", + "description": "the signature that triggered this alert didn't tie to a transaction, so the transaction (and metadata) logged is a forced estimation and may not be the one you expect" + }, + "tx_id": { + "type": "integer" + }, + "verdict": { + "$ref": "#/$defs/verdict_type" + }, + "vlan": { + "type": "array", + "minItems": 1, + "items": { + "type": "number" + } }, "websocket": { "type": "object", + "additionalProperties": false, "properties": { "fin": { "type": "boolean" @@ -7347,17 +7273,13 @@ "payload_printable": { "type": "string" } - }, - "additionalProperties": false - }, - "ndpi": { - "description": "nDPI plugin, contents provided by 3rd party library", - "type": "object" + } } }, "$defs": { "dns.soa": { "type": "object", + "additionalProperties": false, "properties": { "expire": { "type": "integer" @@ -7368,6 +7290,10 @@ "mname": { "type": "string" }, + "mname_truncated": { + "type": "boolean", + "description": "Set to true if the mname was too long and truncated by Suricata" + }, "refresh": { "type": "integer" }, @@ -7379,20 +7305,15 @@ }, "serial": { "type": "integer" - }, - "mname_truncated": { - "description": - "Set to true if the mname was too long and truncated by Suricata", - "type": "boolean" } - }, - "additionalProperties": false + } }, "dns.authorities": { "type": "array", "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { "rdata": { "type": "string", @@ -7402,6 +7323,10 @@ ] } }, + "rdata_truncated": { + "type": "boolean", + "description": "Set to true if the rdata was too long and truncated by Suricata" + }, "rrname": { "type": "string", "suricata": { @@ -7411,27 +7336,20 @@ ] } }, + "rrname_truncated": { + "type": "boolean", + "description": "Set to true if the rrname was too long and truncated by Suricata" + }, "rrtype": { "type": "string" }, - "ttl": { - "type": "integer" - }, "soa": { "$ref": "#/$defs/dns.soa" }, - "rdata_truncated": { - "description": - "Set to true if the rdata was too long and truncated by Suricata", - "type": "boolean" - }, - "rrname_truncated": { - "description": - "Set to true if the rrname was too long and truncated by Suricata", - "type": "boolean" + "ttl": { + "type": "integer" } - }, - "additionalProperties": false + } } }, "dns.additionals": { @@ -7439,7 +7357,24 @@ "minItems": 1, "items": { "type": "object", + "additionalProperties": false, "properties": { + "opt": { + "type": "array", + "minItems": 1, + "items": { + "type": "object", + "additionalProperties": false, + "properties": { + "code": { + "type": "integer" + }, + "data": { + "type": "string" + } + } + } + }, "rdata": { "type": "string", "suricata": { @@ -7462,57 +7397,39 @@ }, "ttl": { "type": "integer" - }, - "opt": { - "type": "array", - "minItems": 1, - "items": { - "type": "object", - "properties": { - "code": { - "type": "integer" - }, - "data": { - "type": "string" - } - }, - "additionalProperties": false - } } - }, - "additionalProperties": false + } } }, "stats_applayer_error": { "type": "object", + "additionalProperties": false, "properties": { - "gap": { - "description": "Number of errors processing gaps", - "type": "integer" - }, "alloc": { - "description": "Number of errors allocating memory", - "type": "integer" + "type": "integer", + "description": "Number of errors allocating memory" }, - "parser": { - "description": "Number of errors reported by parser", - "type": "integer" + "exception_policy": { + "description": "How many times app-layer error exception policy was applied, and which one", + "$ref": "#/$defs/exceptionPolicy" + }, + "gap": { + "type": "integer", + "description": "Number of errors processing gaps" }, "internal": { - "description": "Number of internal parser errors", - "type": "integer" + "type": "integer", + "description": "Number of internal parser errors" }, - "exception_policy": { - "description": - "How many times app-layer error exception policy was applied, and which one", - "$ref": "#/$defs/exceptionPolicy" + "parser": { + "type": "integer", + "description": "Number of errors reported by parser" } - }, - "additionalProperties": false + } }, "tls_date": { - "$comment": "Definition for TLS date formats", "type": "string", + "$comment": "Definition for TLS date formats", "pattern": "^[1-2]\\d{3}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}$" }, "verdict_type": { @@ -7552,6 +7469,10 @@ "exceptionPolicy": { "type": "object", "properties": { + "bypass": { + "type": "integer", + "minimum": 0 + }, "drop_flow": { "type": "integer", "minimum": 0 @@ -7568,10 +7489,6 @@ "type": "integer", "minimum": 0 }, - "bypass": { - "type": "integer", - "minimum": 0 - }, "reject": { "type": "integer", "minimum": 0