ET-3343
📛 Threat Title
Suricata.eve.alert.severity vs metadata’s signature_severity
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- Suricata.eve.alert.severity vs metadata’s signature_severity Emerging Threats Community
Remediations (10)
-
web:community.emergingthreats.net
In Suricata's default classification.config, trojan-activity maps to priority 1: config classification: trojan-activity,A Network Trojan was detected,1 So when Suricata writes to eve.json, the alert gets "severity": 1, regardless of what signature_severity says in metadata. And next CrowdSec acts on the severity field, not the metadata.
-
web:deepwiki.com
EVE JSON is Suricata's unified event logging format that uses JSON for all output types. Each event is a single-line JSON object containing a common header with metadata and event-type-specific fields.
-
web:deepwiki.com
EVE JSON Output Relevant source files Purpose and Scope This document describes Suricata's EVE (Extensible Event Format) JSON output system, which provides structured, machine-readable logging of security events, protocol transactions, and flow metadata. For information about specific event formats and fields, see the schema documentation.
-
web:docs.securityonion.net
Suricata is a free and open source, mature, fast and robust network threat detection engine. Suricata inspects the network traffic using a powerful and extensive rules and signature language, and has powerful Lua scripting support for detection of complex threats. Suricata NIDS alerts can be found in Alerts, Dashboards, Hunt, and Kibana.
-
web:docs.suricata.io
15.1.1. Eve JSON Output The EVE output facility outputs alerts, anomalies, metadata, file info and protocol specific records through JSON. The most common way to use this is through 'EVE', which is a firehose approach where all these logs go into a single file.
-
web:forum.suricata.io
Both severities can be set up by the rule writer (by default it is 1). ref: Suricata alert severity levels and how to verify that the maximum level that can be triggered by a test custom rule There is also signature_severity that is defined in the metadata section of the rule , it has no impact on detection - it is just for information.
-
web:github.com
They can be amended with metadata, such as the application layer record (HTTP, DNS, etc) an alert was generated for, and elements of the rule. The alert is amended with application layer metadata for signatures using application layer keywords.
-
web:github.com
So, your example rule says classtype:pup-activity and it is written in classification.config as config classification: pup-activity,Possibly Unwanted Program Detected,2. Then suricata's rule.severity is 2. After that, common.nids converts to SO's standardized alert severity as event.severity.
-
web:suricataja.readthedocs.io
13.1.1. Eve JSON Output ¶ Suricata can output alerts, http events, dns events, tls events and file info through json. The most common way to use this is through 'EVE', which is a firehose approach where all these logs go into a single file.
-
web:www.opswat.com
Suricata signatures are the classical intrusion-detection backbone of MetaDefender NDR. Every sensor runs the Suricata engine against live packet capture, and every signature that fires becomes an alert in the unified detection pipeline. This chapter covers the engine's role, the rulepacks shipped with the product, the native severity model Suricata uses, and how a Suricata alert reaches the ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.