---
title: "ids.suricata"
canonical: "https://docs.devo.com/space/latest/366280738/ids.suricata"
format: markdown
---
> Macro (toc)

## Introduction

The tags beginning with `ids.suricata` identify events generated by [Suricata](https://suricata.io/).

## Valid tags and data tables 

The full tag must have 3 levels. The first two are fixed as** **`ids.suricata`. The third level identifies the type of events sent.

These are the valid tags and corresponding data tables that will receive the parsers' data:

| **Product / Service** | **Tags** | **Data tables** |
| --- | --- | --- |
| Suricata threat detection engine | `ids.suricata.alert` | `ids.suricata.alert` |
| `ids.suricata.dns` | `ids.suricata.dns` |
| `ids.suricata.dns.json` |
| `ids.suricata.events` | `ids.suricata.events` |
| `ids.suricata.fast` | `ids.suricata.fast` |
| `ids.suricata.fileinfo` | `ids.suricata.fileinfo` |
| `ids.suricata.files` | `ids.suricata.files` |
| `ids.suricata.ftp` | `ids.suricata.ftp` |
| `ids.suricata.ftp_data` | `ids.suricata.ftp_data` |
| `ids.suricata.http` | `ids.suricata.http` |
| `ids.suricata.http.json` |
| `ids.suricata.ikev2` | `ids.suricata.ikev2` |
| `ids.suricata.smb` | `ids.suricata.smb` |
| `ids.suricata.smtp` | `ids.suricata.smtp` |
| `ids.suricata.ssh` | `ids.suricata.ssh` |
| `ids.suricata.stats` | `ids.suricata.stats` |
| `ids.suricata.stdout` | `ids.suricata.stdout` |
| `ids.suricata.tftp` | `ids.suricata.tftp` |

For more information, read more [About Devo tags](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126204).

## Send it

Data should be sent using the [relay](https://docs.devo.com/space/latest/96468993/Devo+Relay).

### Example [relay rules](https://docs.devo.com/space/latest/96469377/Defining+a+relay+rule)

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: ids.suricata.stdout
Sent without syslog tag: false
        Stop processing: false
```

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: ids.suricata.fast
Sent without syslog tag: false
        Stop processing: false
```

```
         Source message: 
            Source data: 
             Source tag: 
             Target tag: ids.suricata.events
Sent without syslog tag: true
        Stop processing: true
```

## Table structure

These are the fields displayed in these tables:

> Macro (rw-ui-tabs-macro)
> 
> > Macro (rw-tab)
> 
> - [ids.suricata.alert](#tag1)
> - [ids.suricata.dns](#tag2)
> - [ids.suricata.events](#tag3)
> - [ids.suricata.fast](#tag4)
> 
> ### > Macro (anchor)
> 
> ids.suricata.alert
> 
> | **Field** | **Type** | ***Extra***** fields** |
> | --- | --- | --- |
> | *eventdate* | `timestamp` |  |
> | *hostname* | `str` |  |
> | *timestamp* | `str` |  |
> | *flowId* | `int8` |  |
> | *inIface* | `str` |  |
> | *eventType* | `str` |  |
> | *vlan* | `str` |  |
> | *srcIp* | `ip4` |  |
> | *srcPort* | `int4` |  |
> | *destIp* | `ip4` |  |
> | *destPort* | `int4` |  |
> | *proto* | `str` |  |
> | *metadataFlowbits* | `str` |  |
> | *metadataFlowintsTcpRetransmissionCount* | `int4` |  |
> | *alertAction* | `str` |  |
> | *alertGid* | `int4` |  |
> | *alertSignatureId* | `int8` |  |
> | *alertRev* | `int4` |  |
> | *alertSignature* | `str` |  |
> | *alertCategory* | `str` |  |
> | *alertSeverity* | `int4` |  |
> | *appProto* | `str` |  |
> | *flowPktsToserver* | `int8` |  |
> | *flowPktsToclient* | `int8` |  |
> | *flowBytesToserver* | `int8` |  |
> | *flowBytesToclient* | `int8` |  |
> | *flowStart* | `str` |  |
> | *hostchain* | `str` | **✓** |
> | *tag* | `str` | **✓** |
> | *rawMessage* | `str` | **✓** |
> 
> ### > Macro (anchor)
> 
> ids.suricata.dns
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` | * * |  |
> | *host* | `str` | *vhost* |  |
> | *timestamp* | `str` | * * |  |
> | *type* | `str` | * * |  |
> | *id* | `int8` | * * |  |
> | *url* | `str` | * * |  |
> | *rrtype* | `str` | * * |  |
> | *src_ip* | `ip4` | * * |  |
> | *src_port* | `int8` | * * |  |
> | *dest_ip* | `ip4` | * * |  |
> | *dest_port* | `int8` | * * |  |
> | *flow_id* | `int8` | * * |  |
> | *in_iface* | `str` | * * |  |
> | *event_type* | `str` | * * |  |
> | *vlan* | `str` | * * |  |
> | *proto* | `str` | * * |  |
> | *dns__version* | `int4` | * * |  |
> | *dns__type* | `str` | * * |  |
> | *dns__id* | `int4` | * * |  |
> | *dns__flags* | `str` | * * |  |
> | *dns__qr* | `bool` | * * |  |
> | *dns__rd* | `bool` | * * |  |
> | *dns__ra* | `bool` | * * |  |
> | *dns__rrname* | `str` | * * |  |
> | *dns__rrtype* | `str` | * * |  |
> | *dns__rcode* | `str` | * * |  |
> | *dns__authorities* | `str` | * * |  |
> | *hostchain* | `str` | * * |  |
> | *tag* | `str` | * * | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> ids.suricata.events
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` | * * |  |
> | *host* | `str` | *vhost* |  |
> | *timestamp* | `str` | * * |  |
> | *flow_id* | `int8` | * * |  |
> | *in_iface* | `str` | * * |  |
> | *event_type* | `str` | * * |  |
> | *src_ip* | `str` | * * |  |
> | *src_port* | `int8` | * * |  |
> | *dest_ip* | `str` | * * |  |
> | *dest_port* | `int8` | * * |  |
> | *proto* | `str` | * * |  |
> | *action* | `str` | * * |  |
> | *gid* | `int8` | * * |  |
> | *signature_id* | `int8` | * * |  |
> | *rev* | `int8` | * * |  |
> | *signature* | `str` | * * |  |
> | *category* | `str` | * * |  |
> | *severity* | `int8` | * * |  |
> | *hostname* | `str` | * * |  |
> | *url* | `str` | * * |  |
> | *http_user_agent* | `str` | * * |  |
> | *http_content_type* | `str` | * * |  |
> | *cookie* | `str` | * * |  |
> | *http_refer* | `str` | * * |  |
> | *http_method* | `str` | * * |  |
> | *protocol* | `str` | * * |  |
> | *status* | `int8` | * * |  |
> | *length* | `int8` | * * |  |
> | *type* | `str` | * * |  |
> | *id* | `int8` | * * |  |
> | *rcode* | `str` | * * |  |
> | *rrname* | `str` | * * |  |
> | *rrtype* | `str` | * * |  |
> | *ttl* | `int8` | * * |  |
> | *rdata* | `str` | * * |  |
> | *hostchain* | `str` | * * |  |
> | *tag* | `str` | * * | **✓** |
> | *rawMessage* | `str` | *rawSource* |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.fast
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *host* | `str` | *vhost* |  |
> | *gid* | `int8` |  |  |
> | *sid* | `int8` |  |  |
> | *ver* | `int8` |  |  |
> | *signature* | `str` |  |  |
> | *classification* | `str` |  |  |
> | *priority* | `int8` |  |  |
> | *protocol* | `str` |  |  |
> | *src_ip* | `ip4` |  |  |
> | *src_port* | `int8` |  |  |
> | *dest_ip* | `ip4` |  |  |
> | *dest_port* | `int8` |  |  |
> | *hostchain* | `str` |  |  |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |
> 
> > Macro (rw-tab)
> 
> - [ids.suricata.fileinfo](#tag5)
> - [ids.suricata.files](#tag6)
> - [ids.suricata.ftp](#tag7)
> - [ids.suricata.ftp_data](#tag8)
> 
> ### > Macro (anchor)
> 
> ids.suricata.fileinfo
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *smb_id* | `int8` |  | * * |  |
> | *smb_dialect* | `str` |  | * * |  |
> | *smb_command* | `str` |  | * * |  |
> | *smb_status* | `str` |  | * * |  |
> | *smb_status_code* | `str` |  | * * |  |
> | *smb_session_id* | `int8` |  | * * |  |
> | *smb_tree_id* | `int8` |  | * * |  |
> | *smb_filename* | `str` |  | * * |  |
> | *smb_share* | `str` |  | * * |  |
> | *smb_fuid* | `str` |  | * * |  |
> | *app_proto* | `str` |  | * * |  |
> | *parent_id* | `int8` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *fileinfo_tx_id* | `int8` |  | * * |  |
> | *fileinfo_size* | `int8` |  | * * |  |
> | *fileinfo_filename* | `str` |  | * * |  |
> | *fileinfo_gaps* | `bool` |  | * * |  |
> | *fileinfo_stored* | `bool` |  | * * |  |
> | *fileinfo_state* | `str` |  | * * |  |
> | *smtp_rcpt_to_str* | `str` | ```
> join(smtp_rcpt_to, ',')
> ``` | *smtp_rcpt_to* |  |
> | *smtp_mail_from* | `str` |  | * * |  |
> | *smtp_helo* | `str` |  | * * |  |
> | *email_status* | `str` |  | * * |  |
> | *email_from* | `str` |  | * * |  |
> | *email_cc_str* | `str` | ```
> join(email_cc, ',')
> ``` | *email_cc* |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.files
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *host* | `str` | *vhost* |  |
> | *timestamp* | `str` |  |  |
> | *ipver* | `int8` |  |  |
> | *srcip* | `str` |  |  |
> | *dstip* | `str` |  |  |
> | *protocol* | `int8` |  |  |
> | *sp* | `int8` |  |  |
> | *dp* | `int8` |  |  |
> | *http_uri* | `str` |  |  |
> | *http_host* | `str` |  |  |
> | *http_referer* | `str` |  |  |
> | *http_user_agent* | `str` |  |  |
> | *filename* | `str` |  |  |
> | *magic* | `str` |  |  |
> | *state* | `str` |  |  |
> | *stored* | `bool` |  |  |
> | *size* | `int8` |  |  |
> | *hostchain* | `str` |  |  |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> ids.suricata.ftp
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *tx_id* | `int8` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *ftp_reply_str* | `str` | ```
> join(ftp_reply, ',')
> ``` | *ftp_reply* |  |
> | *ftp_completion_code_str* | `str` | ```
> join(ftp_completion_code, ',')
> ``` | *ftp_completion_code* |  |
> | *ftp_command* | `str` |  | * * |  |
> | *ftp_dynamic_port* | `int8` |  | * * |  |
> | *ftp_reply_received* | `str` |  | * * |  |
> | *ftp_command_data* | `str` |  | * * |  |
> | *metadata_flowints_applayer_anomaly_count* | `int8` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.ftp_data
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *host* | `str` | *vhost* |  |
> | *timestamp* | `str` | *_timestamp* |  |
> | *src_ip* | `ip4` |  |  |
> | *src_port* | `int8` |  |  |
> | *dest_ip* | `ip4` |  |  |
> | *dest_port* | `int8` |  |  |
> | *event_type* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *tx_id* | `int8` |  |  |
> | *flow_id* | `int8` |  |  |
> | *ftp_data_filename* | `str` |  |  |
> | *ftp_data_command* | `str` |  |  |
> | *parent_id* | `int8` |  |  |
> | *hostchain* | `str` |  | **✓** |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` |  |  |
> 
> > Macro (rw-tab)
> 
> - [ids.suricata.http](#tag9)
> - [ids.suricata.ikev2](#tag10)
> - [ids.suricata.smb](#tag11)
> - [ids.suricata.smtp](#tag12)
> 
> ### > Macro (anchor)
> 
> ids.suricata.http
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *timestamp* | `str` |  |  |
> | *hostname* | `str` |  |  |
> | *url* | `str` |  |  |
> | *user_agent* | `str` |  |  |
> | *src_ip* | `ip4` |  |  |
> | *src_port* | `int8` |  |  |
> | *dest_ip* | `ip4` |  |  |
> | *dest_port* | `int8` |  |  |
> | *flow_id* | `int8` |  |  |
> | *in_iface* | `str` |  |  |
> | *event_type* | `str` |  |  |
> | *vlan* | `str` |  |  |
> | *proto* | `str` |  |  |
> | *tx_id* | `int4` |  |  |
> | *metadata__flowints__applayer_anomaly_count* | `int4` |  |  |
> | *http__url* | `str` |  |  |
> | *http__http_method* | `str` |  |  |
> | *http__length* | `int4` |  |  |
> | *hostchain* | `str` |  |  |
> | *tag* | `str` |  | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> ids.suricata.ikev2
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *errors* | `int8` |  | * * |  |
> | *notify_str* | `str` | ```
> join(notify, ',')
> ``` | *notify* |  |
> | *version_minor* | `int8` |  | * * |  |
> | *version_major* | `int8` |  | * * |  |
> | *exchange_type* | `int8` |  | * * |  |
> | *init_spi* | `str` |  | * * |  |
> | *resp_spi* | `str` |  | * * |  |
> | *message_id* | `int8` |  | * * |  |
> | *payload_str* | `str` | ```
> join(payload, ',')
> ``` | *payload* |  |
> | *role* | `str` |  | * * |  |
> | *alg_auth* | `str` |  | * * |  |
> | *alg_dh* | `str` |  | * * |  |
> | *alg_enc* | `str` |  | * * |  |
> | *alg_prf* | `str` |  | * * |  |
> | *alg_esn* | `str` |  | * * |  |
> | *vlan_str* | `str` | ```
> replace(replace(stringify(json(vlan)), '[', ''), ']', '')
> ``` | *vlan* |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.smb
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *session_id* | `int8` |  | * * |  |
> | *status_code* | `str` |  | * * |  |
> | *status* | `str` |  | * * |  |
> | *command* | `str` |  | * * |  |
> | *disposition* | `str` |  | * * |  |
> | *share_type* | `str` |  | * * |  |
> | *named_pipe* | `str` |  | * * |  |
> | *fuid* | `str` |  | * * |  |
> | *id* | `int8` |  | * * |  |
> | *tree_id* | `int8` |  | * * |  |
> | *directory* | `str` |  | * * |  |
> | *filename* | `str` |  | * * |  |
> | *created* | `timestamp` |  | * * |  |
> | *modified* | `timestamp` |  | * * |  |
> | *changed* | `timestamp` |  | * * |  |
> | *accessed* | `timestamp` |  | * * |  |
> | *access* | `str` |  | * * |  |
> | *size* | `int8` |  | * * |  |
> | *dialect* | `str` |  | * * |  |
> | *client_guid* | `str` |  | * * |  |
> | *client_dialects_str* | `str` | ```
> join(client_dialects, ',')
> ``` | *client_dialects* |  |
> | *server_guid* | `str` |  | * * |  |
> | *kerberos_realm* | `str` |  | * * |  |
> | *kerberos_snames_str* | `str` | ```
> join(kerberos_snames, ',')
> ``` | *kerberos_snames* |  |
> | *dcerpc_res_stub_data_size* | `int8` |  | * * |  |
> | *dcerpc_res_frag_cnt* | `int8` |  | * * |  |
> | *dcerpc_call_id* | `int8` |  | * * |  |
> | *dcerpc_opnum* | `int8` |  | * * |  |
> | *dcerpc_response* | `str` |  | * * |  |
> | *dcerpc_request* | `str` |  | * * |  |
> | *dcerpc_interfaces_uuid* | `[str]` |  | * * |  |
> | *dcerpc_interfaces_version* | `[str]` |  | * * |  |
> | *dcerpc_interfaces_ack_result* | `[int8]` |  | * * |  |
> | *dcerpc_interfaces_ack_reason* | `[int8]` |  | * * |  |
> | *dcerpc_req_stub_data_size* | `int8` |  | * * |  |
> | *dcerpc_req_frag_cnt* | `int8` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.smtp
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *tx_id* | `int8` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *smtp_rcpt_to_str* | `str` | ```
> join(smtp_rcpt_to, ',')
> ``` | *smtp_rcpt_to* |  |
> | *smtp_mail_from* | `str` |  | * * |  |
> | *smtp_helo* | `str` |  | * * |  |
> | *email_url_str* | `str` | ```
> join(email_url, ',')
> ``` | *email_url* |  |
> | *email_status* | `str` |  | * * |  |
> | *email_from2* | `str` |  | * * |  |
> | *email_to_str* | `str` | ```
> join(email_to, ',')
> ``` | *email_to* |  |
> | *vlan_str* | `str` | ```
> replace(replace(stringify(json(vlan)), '[', ''), ']', '')
> ``` | *vlan* |  |
> | *metadata_flowints_applayer_anomaly_count* | `int8` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> > Macro (rw-tab)
> 
> - [ids.suricata.ssh](#tag13)
> - [ids.suricata.stats](#tag14)
> - [ids.suricata.stdout](#tag15)
> - [ids.suricata.tftp](#tag16)
> 
> ### > Macro (anchor)
> 
> ids.suricata.ssh
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` | * * |  |
> | *host* | `str` | *vhost* |  |
> | *timestamp* | `str` | *_timestamp* |  |
> | *event_type* | `str` | * * |  |
> | *proto* | `str` | * * |  |
> | *src_ip* | `ip4` | * * |  |
> | *src_port* | `int8` | * * |  |
> | *dest_ip* | `ip4` | * * |  |
> | *dest_port* | `int8` | * * |  |
> | *flow_id* | `int8` | * * |  |
> | *client2_proto_version* | `str` | * * |  |
> | *client2_software_version* | `str` | * * |  |
> | *server_proto_version* | `str` | * * |  |
> | *server_software_version* | `str` | * * |  |
> | *hostchain* | `str` | * * | **✓** |
> | *tag* | `str` | * * | **✓** |
> | *rawMessage* | `str` | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.stats
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *hostname* | `str` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *flow_spare* | `int8` |  | * * |  |
> | *flow_emerg_mode_entered* | `int8` |  | * * |  |
> | *flow_tcp_reuse* | `int8` |  | * * |  |
> | *flow_memuse* | `int8` |  | * * |  |
> | *flow_memcap* | `int8` |  | * * |  |
> | *flow_emerg_mode_over* | `int8` |  | * * |  |
> | *flow_udp* | `int8` |  | * * |  |
> | *flow_tcp* | `int8` |  | * * |  |
> | *flow_icmpv6* | `int8` |  | * * |  |
> | *flow_icmpv4* | `int8` |  | * * |  |
> | *uptime* | `int8` |  | * * |  |
> | *detect_engines_last_reload_str* | `str` | ```
> join(detect_engines_last_reload, ',')
> ``` | *detect_engines_last_reload* |  |
> | *detect_engines_rules_failed_str* | `str` | ```
> replace(replace(stringify(json(detect_engines_rules_failed)), '[', ''), ']', '')
> ``` | *detect_engines_rules_failed* |  |
> | *detect_engines_id_str* | `str` | ```
> replace(replace(stringify(json(detect_engines_id)), '[', ''), ']', '')
> ``` | *detect_engines_id* |  |
> | *detect_engines_rules_loaded_str* | `str` | ```
> replace(replace(stringify(json(detect_engines_rules_loaded)), '[', ''), ']', '')
> ``` | *detect_engines_rules_loaded* |  |
> | *detect_alert* | `int8` |  | * * |  |
> | *flow_mgr_new_pruned* | `int8` |  | * * |  |
> | *flow_mgr_flows_timeout_inuse* | `int8` |  | * * |  |
> | *flow_mgr_est_pruned* | `int8` |  | * * |  |
> | *flow_mgr_rows_maxlen* | `int8` |  | * * |  |
> | *flow_mgr_rows_skipped* | `int8` |  | * * |  |
> | *flow_mgr_flows_notimeout* | `int8` |  | * * |  |
> | *flow_mgr_rows_busy* | `int8` |  | * * |  |
> | *flow_mgr_closed_pruned* | `int8` |  | * * |  |
> | *flow_mgr_rows_empty* | `int8` |  | * * |  |
> | *flow_mgr_flows_checked* | `int8` |  | * * |  |
> | *flow_mgr_flows_timeout* | `int8` |  | * * |  |
> | *flow_mgr_bypassed_pruned* | `int8` |  | * * |  |
> | *flow_mgr_rows_checked* | `int8` |  | * * |  |
> | *flow_mgr_flows_removed* | `int8` |  | * * |  |
> | *ftp_memuse* | `int8` |  | * * |  |
> | *ftp_memcap* | `int8` |  | * * |  |
> | *defrag_max_frag_hits* | `int8` |  | * * |  |
> | *defrag_ipv4_reassembled* | `int8` |  | * * |  |
> | *defrag_ipv4_timeouts* | `int8` |  | * * |  |
> | *defrag_ipv4_fragments* | `int8` |  | * * |  |
> | *defrag_ipv6_reassembled* | `int8` |  | * * |  |
> | *defrag_ipv6_timeouts* | `int8` |  | * * |  |
> | *defrag_ipv6_fragments* | `int8` |  | * * |  |
> | *http_memuse* | `int8` |  | * * |  |
> | *http_memcap* | `int8` |  | * * |  |
> | *tcp_insert_data_overlap_fail* | `int8` |  | * * |  |
> | *tcp_no_flow* | `int8` |  | * * |  |
> | *tcp_memuse* | `int8` |  | * * |  |
> | *tcp_ssn_memcap_drop* | `int8` |  | * * |  |
> | *tcp_overlap* | `int8` |  | * * |  |
> | *tcp_overlap_diff_data* | `int8` |  | * * |  |
> | *tcp_invalid_checksum* | `int8` |  | * * |  |
> | *tcp_synack* | `int8` |  | * * |  |
> | *tcp_stream_depth_reached* | `int8` |  | * * |  |
> | *tcp_syn* | `int8` |  | * * |  |
> | *tcp_insert_data_normal_fail* | `int8` |  | * * |  |
> | *tcp_rst* | `int8` |  | * * |  |
> | *tcp_pkt_on_wrong_thread* | `int8` |  | * * |  |
> | *tcp_sessions* | `int8` |  | * * |  |
> | *tcp_insert_list_fail* | `int8` |  | * * |  |
> | *tcp_reassembly_memuse* | `int8` |  | * * |  |
> | *tcp_pseudo* | `int8` |  | * * |  |
> | *tcp_reassembly_gap* | `int8` |  | * * |  |
> | *tcp_segment_memcap_drop* | `int8` |  | * * |  |
> | *tcp_midstream_pickups* | `int8` |  | * * |  |
> | *tcp_pseudo_failed* | `int8` |  | * * |  |
> | *capture_dag_packets* | `int8` |  | * * |  |
> | *capture_dag_drops* | `int8` |  | * * |  |
> | *decoder_dce_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_mpls* | `int8` |  | * * |  |
> | *decoder_ipv6* | `int8` |  | * * |  |
> | *decoder_event_ltnull_unsupported_type* | `int8` |  | * * |  |
> | *decoder_event_ltnull_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv6_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_ah* | `int8` |  | * * |  |
> | *decoder_event_ipv6_fh_non_zero_reserved_field* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_invalid_optlen* | `int8` |  | * * |  |
> | *decoder_event_ipv6_frag_ignored* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_ah_res_not_null* | `int8` |  | * * |  |
> | *decoder_event_ipv6_frag_overlap* | `int8` |  | * * |  |
> | *decoder_event_ipv6_frag_pkt_too_large* | `int8` |  | * * |  |
> | *decoder_event_ipv6_wrong_ip_version* | `int8` |  | * * |  |
> | *decoder_event_ipv6_data_after_none_header* | `int8` |  | * * |  |
> | *decoder_event_ipv6_trunc_exthdr* | `int8` |  | * * |  |
> | *decoder_event_ipv6_ipv4_in_ipv6_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_useless_fh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_dh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_dstopts_only_padding* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_rh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_hopopts_unknown_opt* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_eh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_trunc_pkt* | `int8` |  | * * |  |
> | *decoder_event_ipv6_ipv6_in_ipv6_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv6_ipv6_in_ipv6_wrong_version* | `int8` |  | * * |  |
> | *decoder_event_ipv6_hopopts_only_padding* | `int8` |  | * * |  |
> | *decoder_event_ipv6_rh_type_0* | `int8` |  | * * |  |
> | *decoder_event_ipv6_dstopts_unknown_opt* | `int8` |  | * * |  |
> | *decoder_event_ipv6_ipv4_in_ipv6_wrong_version* | `int8` |  | * * |  |
> | *decoder_event_ipv6_zero_len_padn* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_hh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_exthdr_dupl_fh* | `int8` |  | * * |  |
> | *decoder_event_ipv6_icmpv4* | `int8` |  | * * |  |
> | *decoder_event_ipv6_unknown_next_header* | `int8` |  | * * |  |
> | *decoder_event_mpls_bad_label_reserved* | `int8` |  | * * |  |
> | *decoder_event_mpls_bad_label_implicit_null* | `int8` |  | * * |  |
> | *decoder_event_mpls_header_too_small* | `int8` |  | * * |  |
> | *decoder_event_mpls_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_mpls_bad_label_router_alert* | `int8` |  | * * |  |
> | *decoder_event_mpls_unknown_payload_type* | `int8` |  | * * |  |
> | *decoder_event_ieee8021ah_header_too_small* | `int8` |  | * * |  |
> | *decoder_event_pppoe_malformed_tags* | `int8` |  | * * |  |
> | *decoder_event_pppoe_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_pppoe_wrong_code* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_mld_message_with_invalid_hl* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_unknown_type* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_unassigned_type* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_experimentation_type* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_unknown_code* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_ipv6_trunc_pkt* | `int8` |  | * * |  |
> | *decoder_event_icmpv6_ipv6_unknown_version* | `int8` |  | * * |  |
> | *decoder_event_tcp_invalid_optlen* | `int8` |  | * * |  |
> | *decoder_event_tcp_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_tcp_hlen_too_small* | `int8` |  | * * |  |
> | *decoder_event_tcp_opt_duplicate* | `int8` |  | * * |  |
> | *decoder_event_tcp_opt_invalid_len* | `int8` |  | * * |  |
> | *decoder_event_ipraw_invalid_ip_version* | `int8` |  | * * |  |
> | *decoder_event_ipv4_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_unknown* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_eol_required* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_invalid_len* | `int8` |  | * * |  |
> | *decoder_event_ipv4_icmpv6* | `int8` |  | * * |  |
> | *decoder_event_ipv4_frag_ignored* | `int8` |  | * * |  |
> | *decoder_event_ipv4_trunc_pkt* | `int8` |  | * * |  |
> | *decoder_event_ipv4_hlen_too_small* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_duplicate* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_invalid* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_malformed* | `int8` |  | * * |  |
> | *decoder_event_ipv4_frag_overlap* | `int8` |  | * * |  |
> | *decoder_event_ipv4_frag_pkt_too_large* | `int8` |  | * * |  |
> | *decoder_event_ipv4_wrong_ip_version* | `int8` |  | * * |  |
> | *decoder_event_ipv4_iplen_smaller_than_hlen* | `int8` |  | * * |  |
> | *decoder_event_ipv4_opt_pad_required* | `int8` |  | * * |  |
> | *decoder_event_ethernet_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_erspan_unsupported_version* | `int8` |  | * * |  |
> | *decoder_event_erspan_header_too_small* | `int8` |  | * * |  |
> | *decoder_event_erspan_too_many_vlan_layers* | `int8` |  | * * |  |
> | *decoder_event_gre_version0_flags* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_recur* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_wrong_protocol* | `int8` |  | * * |  |
> | *decoder_event_gre_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_gre_version0_recur* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_route* | `int8` |  | * * |  |
> | *decoder_event_gre_wrong_version* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_ssr* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_flags* | `int8` |  | * * |  |
> | *decoder_event_gre_version0_malformed_sre_hdr* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_no_key* | `int8` |  | * * |  |
> | *decoder_event_gre_version0_hdr_too_big* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_hdr_too_big* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_malformed_sre_hdr* | `int8` |  | * * |  |
> | *decoder_event_gre_version1_chksum* | `int8` |  | * * |  |
> | *decoder_event_udp_hlen_invalid* | `int8` |  | * * |  |
> | *decoder_event_udp_hlen_too_small* | `int8` |  | * * |  |
> | *decoder_event_udp_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_vlan_unknown_type* | `int8` |  | * * |  |
> | *decoder_event_vlan_header_too_small* | `int8` |  | * * |  |
> | *decoder_event_vlan_too_many_layers* | `int8` |  | * * |  |
> | *decoder_event_ppp_unsup_proto* | `int8` |  | * * |  |
> | *decoder_event_ppp_ip6_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ppp_wrong_type* | `int8` |  | * * |  |
> | *decoder_event_ppp_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ppp_vju_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_ppp_ip4_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_sctp_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_sll_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_icmpv4_ipv4_unknown_ver* | `int8` |  | * * |  |
> | *decoder_event_icmpv4_unknown_type* | `int8` |  | * * |  |
> | *decoder_event_icmpv4_pkt_too_small* | `int8` |  | * * |  |
> | *decoder_event_icmpv4_ipv4_trunc_pkt* | `int8` |  | * * |  |
> | *decoder_event_icmpv4_unknown_code* | `int8` |  | * * |  |
> | *decoder_teredo* | `int8` |  | * * |  |
> | *decoder_pppoe* | `int8` |  | * * |  |
> | *decoder_icmpv6* | `int8` |  | * * |  |
> | *decoder_null* | `int8` |  | * * |  |
> | *decoder_ethernet* | `int8` |  | * * |  |
> | *decoder_vlan* | `int8` |  | * * |  |
> | *decoder_sctp* | `int8` |  | * * |  |
> | *decoder_max_pkt_size* | `int8` |  | * * |  |
> | *decoder_sll* | `int8` |  | * * |  |
> | *decoder_ipv6_in_ipv6* | `int8` |  | * * |  |
> | *decoder_ipv4_in_ipv6* | `int8` |  | * * |  |
> | *decoder_ieee8021ah* | `int8` |  | * * |  |
> | *decoder_avg_pkt_size* | `int8` |  | * * |  |
> | *decoder_tcp* | `int8` |  | * * |  |
> | *decoder_ipv4* | `int8` |  | * * |  |
> | *decoder_vlan_qinq* | `timestamp` |  | * * |  |
> | *decoder_gre* | `timestamp` |  | * * |  |
> | *decoder_raw2* | `int8` |  | * * |  |
> | *decoder_erspan* | `int8` |  | * * |  |
> | *decoder_udp* | `timestamp` |  | * * |  |
> | *decoder_ppp* | `int8` |  | * * |  |
> | *decoder_bytes* | `int8` |  | * * |  |
> | *decoder_pkts* | `int8` |  | * * |  |
> | *decoder_invalid* | `int8` |  | * * |  |
> | *decoder_icmpv4* | `int8` |  | * * |  |
> | *decoder_vxlan* | `int8` |  | * * |  |
> | *app_layer_tx_ssh* | `int8` |  | * * |  |
> | *app_layer_tx_dns_udp* | `int8` |  | * * |  |
> | *app_layer_tx_tftp* | `int8` |  | * * |  |
> | *app_layer_tx_ftp* | `int8` |  | * * |  |
> | *app_layer_tx_dcerpc_tcp* | `int8` |  | * * |  |
> | *app_layer_tx_ftp_data* | `int8` |  | * * |  |
> | *app_layer_tx_ntp* | `int8` |  | * * |  |
> | *app_layer_tx_dns_tcp* | `int8` |  | * * |  |
> | *app_layer_tx_smb* | `int8` |  | * * |  |
> | *app_layer_tx_nfs_udp* | `int8` |  | * * |  |
> | *app_layer_tx_dcerpc_udp* | `int8` |  | * * |  |
> | *app_layer_tx_nfs_tcp* | `int8` |  | * * |  |
> | *app_layer_tx_imap* | `int8` |  | * * |  |
> | *app_layer_tx_smtp* | `int8` |  | * * |  |
> | *app_layer_tx_ikev2* | `int8` |  | * * |  |
> | *app_layer_expectations* | `int8` |  | * * |  |
> | *app_layer_flow_ssh* | `int8` |  | * * |  |
> | *app_layer_flow_dns_udp* | `int8` |  | * * |  |
> | *app_layer_flow_tftp* | `int8` |  | * * |  |
> | *app_layer_flow_ftp* | `int8` |  | * * |  |
> | *app_layer_flow_dcerpc_tcp* | `int8` |  | * * |  |
> | *app_layer_flow_ftp_data* | `int8` |  | * * |  |
> | *app_layer_flow_ntp* | `int8` |  | * * |  |
> | *app_layer_flow_failed_udp* | `int8` |  | * * |  |
> | *app_layer_flow_dns_tcp* | `int8` |  | * * |  |
> | *app_layer_flow_smb* | `int8` |  | * * |  |
> | *app_layer_flow_nfs_udp* | `int8` |  | * * |  |
> | *app_layer_flow_dcerpc_udp* | `int8` |  | * * |  |
> | *app_layer_flow_failed_tcp* | `int8` |  | * * |  |
> | *app_layer_flow_nfs_tcp* | `int8` |  | * * |  |
> | *app_layer_flow_imap* | `int8` |  | * * |  |
> | *app_layer_flow_smtp* | `int8` |  | * * |  |
> | *app_layer_flow_ikev2* | `int8` |  | * * |  |
> | *flow_bypassed_local_bytes* | `int8` |  | * * |  |
> | *flow_bypassed_local_capture_pkts* | `int8` |  | * * |  |
> | *flow_bypassed_closed* | `int8` |  | * * |  |
> | *flow_bypassed_bytes* | `int8` |  | * * |  |
> | *flow_bypassed_local_pkts* | `int8` |  | * * |  |
> | *flow_bypassed_local_capture_bytes* | `int8` |  | * * |  |
> | *flow_bypassed_pkts* | `int8` |  | * * |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |
> 
> ### > Macro (anchor)
> 
> ids.suricata.stdout
> 
> | **Field** | **Type** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  |  |
> | *host* | `str` | *vhost* |  |
> | *date* | `str` | * * |  |
> | *hour* | `str` | * * |  |
> | *type* | `str` | * * |  |
> | *error_code* | `str` | * * |  |
> | *message* | `str` | * * |  |
> | *hostchain* | `str` | * * |  |
> | *tag* | `str` | * * | **✓** |
> | *rawMessage* | `str` | *rawSource* | **✓** |
> 
> ### > Macro (anchor)
> 
> ids.suricata.tftp
> 
> | **Field** | **Type** | **Field transformation** | **Source field name** | ***Extra***** fields** |
> | --- | --- | --- | --- | --- |
> | *eventdate* | `timestamp` |  | * * |  |
> | *host* | `str` |  | *vhost* |  |
> | *timestamp* | `str` |  | *_timestamp* |  |
> | *event_type* | `str` |  | * * |  |
> | *src_ip* | `ip4` |  | * * |  |
> | *src_port* | `int8` |  | * * |  |
> | *dest_ip* | `ip4` |  | * * |  |
> | *dest_port* | `int8` |  | * * |  |
> | *proto* | `str` |  | * * |  |
> | *flow_id* | `int8` |  | * * |  |
> | *packet* | `str` |  | * * |  |
> | *file* | `str` |  | * * |  |
> | *mode* | `str` |  | * * |  |
> | *vlan_str* | `str` | ```
> replace(replace(stringify(json(vlan)), '[', ''), ']', '')
> ``` | *vlan* |  |
> | *hostchain* | `str` |  | * * | **✓** |
> | *tag* | `str` |  | * * | **✓** |
> | *rawMessage* | `str` |  | * * |  |