{"timestamp":"2011-08-12T16:52:57.716360","flow_id":1031464864740687,"pcap_cnt":83,"vlan":null,"in_iface":null,"src_ip":"147.32.84.165","src_port":1181,"dest_ip":"78.40.125.4","dest_port":6667,"proto":"TCP","event_type":"alert","community_id":null,"alert":{"app_proto":null,"action":"allowed","gid":1,"signature_id":2017318,"rev":4,"signature":"ET CURRENT_EVENTS SUSPICIOUS IRC - PRIVMSG *.(exe|tar|tgz|zip)  download command","category":"Potentially Bad Traffic","severity":2,"source":{"ip":null,"port":null},"target":{"ip":null,"port":null}},"flow":{"pkts_toserver":27,"pkts_toclient":35,"bytes_toserver":2302,"bytes_toclient":4520,"start":"2011-08-12T16:47:24.357711","end":null,"age":null,"state":null,"reason":null,"alerted":null},"payload":"UFJJVk1TRyAjemFyYXNhNDggOiBzbXNzLmV4ZSAoMzY4KQ0K","payload_printable":"PRIVMSG #zarasa48 : smss.exe (368)\r\n","stream":0,"packet":"AB5J2xnDCAAntbcZCABFAABMGV5AAIAGLlyTIFSlTih9BASdGgvw0QvAxUWHdVAY+rCL4gAAUFJJVk1TRyAjemFyYXNhNDggOiBzbXNzLmV4ZSAoMzY4KQ0K","packet_info":{"linktype":1}}
{"timestamp":"2011-08-12T16:55:22.154618","flow_id":2247896271051770,"pcap_cnt":775,"vlan":null,"in_iface":null,"src_ip":"147.32.84.165","src_port":1141,"dest_ip":"147.32.80.9","dest_port":53,"proto":"UDP","event_type":"dns","community_id":null,"dns":{"type":"query","id":553,"flags":null,"rrname":"irc.freenode.net","rrtype":"A","rcode":null,"rdata":null,"ttl":null,"tx_id":0}}
{"timestamp":"2011-08-12T17:00:36.378914","flow_id":269421754201300,"pcap_cnt":22569,"vlan":null,"in_iface":null,"src_ip":"147.32.84.165","src_port":1027,"dest_ip":"74.125.232.202","dest_port":80,"proto":"TCP","event_type":"http","community_id":null,"http":{"hostname":"cr-tools.clients.google.com","url":"/service/check2?appid=%7B430FD4D0-B729-4F61-AA34-91526481799D%7D&appversion=1.3.21.65&applang=&machine=0&version=1.3.21.65&osversion=5.1&servicepack=Service%20Pack%202","http_port":null,"http_user_agent":"Google Update/1.3.21.65;winhttp","http_content_type":null,"http_method":"GET","http_refer":null,"protocol":"HTTP/1.1","status":null,"redirect":null,"length":0},"tx_id":0}
{"timestamp":"2011-08-12T18:59:22.181050","flow_id":472067367468746,"pcap_cnt":25767,"vlan":null,"in_iface":null,"src_ip":"74.207.254.18","src_port":80,"dest_ip":"147.32.84.165","dest_port":1046,"proto":"TCP","event_type":"fileinfo","community_id":null,"fileinfo":{"filename":"/","magic":"HTML document, ASCII text","gaps":false,"state":"CLOSED","md5":"70041821acf87389e40ddcb092004184","sha1":"10395ab3566395ca050232d2c1a0dbad69eb5fd2","sha256":"2e4c462b3424afcc04f43429d5f001e4ef9a28143bfeefb9af2254b4df3a7c1a","stored":true,"file_id":1,"size":301,"tx_id":0},"http":{"hostname":"www.nmap.org","url":"/","http_port":null,"http_user_agent":"Mozilla/4.0 (compatible)","http_content_type":"text/html","http_method":"GET","http_refer":null,"protocol":"HTTP/1.1","status":301,"redirect":"http://nmap.org/","length":301},"app_proto":"http"}
{"timestamp":"2011-08-14T09:38:53.914038","flow_id":929669869939483,"pcap_cnt":null,"vlan":null,"in_iface":null,"src_ip":"147.32.84.165","src_port":138,"dest_ip":"147.32.84.255","dest_port":138,"proto":"UDP","event_type":"flow","community_id":null,"flow":{"pkts_toserver":2,"pkts_toclient":0,"bytes_toserver":486,"bytes_toclient":0,"start":"2011-08-12T16:53:47.928539","end":"2011-08-12T16:53:47.928552","age":0,"state":"new","reason":"timeout","alerted":false},"app_proto":"failed"}
{"timestamp":"2011-08-14T09:38:55.549713","flow_id":929669869939483,"pcap_cnt":null,"vlan":null,"in_iface":null,"src_ip":"147.32.84.165","src_port":138,"dest_ip":"147.32.84.255","dest_port":138,"proto":"UDP","event_type":"netflow","community_id":null,"netflow":{"pkts":2,"bytes":486,"start":"2011-08-12T16:53:47.928539","end":"2011-08-12T16:53:47.928552","age":0},"app_proto":"failed"}
{"timestamp":"2019-05-02T17:56:53.843674"}
