{"timestamp": "2011-08-12T16:52:57.716360", "flow_id": 1031464864740687, "pcap_cnt": 83, "vlan": null, "in_iface": null, "src_ip": "147.32.84.165", "src_port": 1181, "dest_ip": "78.40.125.4", "dest_port": 6667, "proto": "TCP", "event_type": "alert", "community_id": null, "alert": {"app_proto": null, "action": "allowed", "gid": 1, "signature_id": 2017318, "rev": 4, "signature": "ET CURRENT_EVENTS SUSPICIOUS IRC - PRIVMSG *.(exe|tar|tgz|zip)  download command", "category": "Potentially Bad Traffic", "severity": 2, "source": {"ip": null, "port": null}, "target": {"ip": null, "port": null}}, "flow": {"pkts_toserver": 27, "pkts_toclient": 35, "bytes_toserver": 2302, "bytes_toclient": 4520, "start": "2011-08-12T16:47:24.357711", "end": null, "age": null, "state": null, "reason": null, "alerted": null}, "payload": "UFJJVk1TRyAjemFyYXNhNDggOiBzbXNzLmV4ZSAoMzY4KQ0K", "payload_printable": "PRIVMSG #zarasa48 : smss.exe (368)\r\n", "stream": 0, "packet": "AB5J2xnDCAAntbcZCABFAABMGV5AAIAGLlyTIFSlTih9BASdGgvw0QvAxUWHdVAY+rCL4gAAUFJJVk1TRyAjemFyYXNhNDggOiBzbXNzLmV4ZSAoMzY4KQ0K", "packet_info": {"linktype": 1}}
{"timestamp": "2011-08-12T16:55:22.154618", "flow_id": 2247896271051770, "pcap_cnt": 775, "vlan": null, "in_iface": null, "src_ip": "147.32.84.165", "src_port": 1141, "dest_ip": "147.32.80.9", "dest_port": 53, "proto": "UDP", "event_type": "dns", "community_id": null, "dns": {"type": "query", "id": 553, "flags": null, "rrname": "irc.freenode.net", "rrtype": "A", "rcode": null, "rdata": null, "ttl": null, "tx_id": 0}}
{"timestamp": "2011-08-12T17:00:36.378914", "flow_id": 269421754201300, "pcap_cnt": 22569, "vlan": null, "in_iface": null, "src_ip": "147.32.84.165", "src_port": 1027, "dest_ip": "74.125.232.202", "dest_port": 80, "proto": "TCP", "event_type": "http", "community_id": null, "http": {"hostname": "cr-tools.clients.google.com", "url": "/service/check2?appid=%7B430FD4D0-B729-4F61-AA34-91526481799D%7D&appversion=1.3.21.65&applang=&machine=0&version=1.3.21.65&osversion=5.1&servicepack=Service%20Pack%202", "http_port": null, "http_user_agent": "Google Update/1.3.21.65;winhttp", "http_content_type": null, "http_method": "GET", "http_refer": null, "protocol": "HTTP/1.1", "status": null, "redirect": null, "length": 0}, "tx_id": 0}
{"timestamp": "2011-08-12T18:59:22.181050", "flow_id": 472067367468746, "pcap_cnt": 25767, "vlan": null, "in_iface": null, "src_ip": "74.207.254.18", "src_port": 80, "dest_ip": "147.32.84.165", "dest_port": 1046, "proto": "TCP", "event_type": "fileinfo", "community_id": null, "fileinfo": {"filename": "/", "magic": "HTML document, ASCII text", "gaps": false, "state": "CLOSED", "md5": "70041821acf87389e40ddcb092004184", "sha1": "10395ab3566395ca050232d2c1a0dbad69eb5fd2", "sha256": "2e4c462b3424afcc04f43429d5f001e4ef9a28143bfeefb9af2254b4df3a7c1a", "stored": true, "file_id": 1, "size": 301, "tx_id": 0}, "http": {"hostname": "www.nmap.org", "url": "/", "http_port": null, "http_user_agent": "Mozilla/4.0 (compatible)", "http_content_type": "text/html", "http_method": "GET", "http_refer": null, "protocol": "HTTP/1.1", "status": 301, "redirect": "http://nmap.org/", "length": 301}, "app_proto": "http"}
{"timestamp": "2011-08-14T09:38:53.914038", "flow_id": 929669869939483, "pcap_cnt": null, "vlan": null, "in_iface": null, "src_ip": "147.32.84.165", "src_port": 138, "dest_ip": "147.32.84.255", "dest_port": 138, "proto": "UDP", "event_type": "flow", "community_id": null, "flow": {"pkts_toserver": 2, "pkts_toclient": 0, "bytes_toserver": 486, "bytes_toclient": 0, "start": "2011-08-12T16:53:47.928539", "end": "2011-08-12T16:53:47.928552", "age": 0, "state": "new", "reason": "timeout", "alerted": false}, "app_proto": "failed"}
{"timestamp": "2011-08-14T09:38:55.549713", "flow_id": 929669869939483, "pcap_cnt": null, "vlan": null, "in_iface": null, "src_ip": "147.32.84.165", "src_port": 138, "dest_ip": "147.32.84.255", "dest_port": 138, "proto": "UDP", "event_type": "netflow", "community_id": null, "netflow": {"pkts": 2, "bytes": 486, "start": "2011-08-12T16:53:47.928539", "end": "2011-08-12T16:53:47.928552", "age": 0}, "app_proto": "failed"}
{"timestamp": "2019-05-02T17:56:53.843674"}
