{
  "stream": 0,
  "host": "discord-probe",
  "dest_port": 53,
  "in_iface": "tppdummy0",
  "sig": {
    "updated": "2023-08-16",
    "source": "NRD30Entropy",
    "created": "2022-04-29"
  },
  "@version": "1",
  "event_type": "alert",
  "hostname_info": {
    "host": "mail.infinitesource.com",
    "url": "mail.infinitesource.com",
    "domain": "infinitesource.com",
    "tld": "com",
    "subdomain": "mail",
    "domain_without_tld": "infinitesource"
  },
  "see_id": "6c2b59a0d0f2",
  "see_name": "STS-500-QALAB-SSP",
  "type": "json-log",
  "alert": {
    "signature_id": 3115010,
    "severity": 3,
    "action": "allowed",
    "gid": 1,
    "rev": 3,
    "signature": "SN NRD Entropy 30 day range domain",
    "category": "Unknown Traffic",
    "metadata": {
      "updated_at": [
        "2023_08_16"
      ],
      "nrd_period": [
        "30_days"
      ],
      "provider": [
        "Stamus"
      ],
      "nrd_key": [
        "dns.query.rrname"
      ],
      "created_at": [
        "2022_04_29"
      ],
      "nrd_asset": [
        "src_ip"
      ],
      "stamus_classification": [
        "nrd_entropy"
      ]
    },
    "lateral": "private-class-a"
  },
  "packet_info": {
    "linktype": 1
  },
  "tx_id": 2,
  "app_proto": "dns",
  "dest_ip": "10.6.5.1",
  "metadata": {
    "flowbits": [
      "stamus.nrd",
      "stamus.nrd.entropy"
    ]
  },
  "logger": "logstash-manager",
  "tags": [
    "beats_input_codec_json_applied"
  ],
  "proto": "UDP",
  "flow": {
    "bytes_toclient": 142,
    "start": "2023-10-19T21:50:39.711431+0200",
    "src_port": 56766,
    "dest_port": 53,
    "pkts_toclient": 1,
    "pkts_toserver": 2,
    "bytes_toserver": 168,
    "dest_ip": "10.6.5.1",
    "src_ip": "10.6.5.102"
  },
  "src_ip": "10.6.5.102",
  "log": {
    "offset": 1071939338,
    "file": {
      "path": "/var/log/suricata/eve-alert.json"
    }
  },
  "@timestamp": "2023-10-19T19:50:40.305Z",
  "payload_printable": ".............mail.infinitesource.com.....",
  "src_port": 56766,
  "agent": {
    "type": "filebeat",
    "hostname": "discord-probe",
    "ephemeral_id": "fb7be2ea-f53c-4100-9688-329299e45b01",
    "id": "9f305fa4-6db1-485c-81f9-598dce1469e3",
    "version": "7.17.10",
    "name": "discord-probe"
  },
  "dns": {
    "query": [
      {
        "type": "query",
        "rrname": "mail.infinitesource.com",
        "id": 4995,
        "tx_id": 2,
        "rrtype": "A"
      }
    ]
  },
  "flow_id": 2211150381438956,
  "alerted": true,
  "ether": {
    "src_mac": "00:08:02:1c:47:ae",
    "dest_mac": "20:e5:2a:b6:93:f1"
  },
  "packet": "IOUqtpPxAAgCHEeuCABFAABFVbQAAIARxoEKBgVmCgYFAd2+ADUAMaj+E4MBAAABAAAAAAAABG1haWwOaW5maW5pdGVzb3VyY2UDY29tAAABAAE=",
  "tenant": 9,
  "net_info": {
    "dest_agg": "private-class-a.internet",
    "src": [
      "Private class A",
      "Internet"
    ],
    "src_agg": "private-class-a.internet",
    "dest": [
      "Private class A",
      "Internet"
    ]
  },
  "timestamp": "2023-10-19T21:50:40.305771+0200",
  "input": {
    "type": "log"
  },
  "capture_file": "/var/log/suricata/pcaps//log-1697744497-2.pcap",
  "_id": "mw17SYsBmjVXQHqtaxJC"
}