Suricata alerts with jq

Alerts are where triage usually starts

A network IDS such as Suricata watches traffic and raises an alert when it matches a rule. It writes them as JSON — one object per line — in eve.json. jq is the tool for JSON: count the alerts first,

jq -s 'length' /srv/soc-data/nids/eve.json

In the terminal

student@vulntech:~$ jq -s 'length' /srv/soc-data/nids/eve.json
3

then print the field that matters — the rule each alert fired, with its source IP:

jq -c '{src_ip, signature: .alert.signature, severity: .alert.severity}' /srv/soc-data/nids/eve.json

In the terminal

student@vulntech:~$ jq -c '{src_ip, signature: .alert.signature, severity: .alert.severity}' /srv/soc-data/nids/eve.json
{"src_ip":"203.0.113.66","signature":"ET SCAN Potential TCP Port Scan","severity":2}
{"src_ip":"10.10.10.5","signature":"ET DNS Query to a suspicious .net C2 domain","severity":1}
{"src_ip":"203.0.113.66","signature":"ET WEB_SERVER PHP webshell access","severity":1}

Tip: In Suricata, a lower severity number means a more serious alert (severity 1 is the top). Analysts work the lowest numbers first.