Examples

These examples help illustrate the concepts discussed in this document. Also, the structures in the Suricata EVE JSON log snippets show how the metadata key-value pairs should be logically interpreted.

Example 1

This metadata keyword in a rule:

metadata:cwe_id 20,cvss_v3_base 7.3,hostile src_ip,created_at 2019-06-01,capec_id 248,updated_at 2019-06-11,
filename exploit.rules,priority medium,rule_source acme-rule-factory,cvss_v2_base 8.1,attack_target server,
attack_target smtp-server,cvss_v3_temporal 7.1,cve 2019-91325,cvss_v2_temporal 7.9,mitre_attack t1190,
protocols smtp,protocols tcp;

Results in this in the Suricata EVE JSON log:

{
  "metadata": {
    "protocols": [
      "tcp",
      "smtp"
    ],
    "mitre_attack": [
      "t1190"
    ],
    "cvss_v2_temporal": [
      "7.9"
    ],
    "cve": [
      "2019-91325"
    ],
    "cvss_v3_temporal": [
      "7.1"
    ],
    "attack_target": [
      "smtp-server",
      "server"
    ],
    "cvss_v2_base": [
      "8.1"
    ],
    "rule_source": [
      "acme-rule-factory"
    ],
    "priority": [
      "medium"
    ],
    "filename": [
      "exploit.rules"
    ],
    "updated_at": [
      "2019-06-11"
    ],
    "capec_id": [
      "248"
    ],
    "created_at": [
      "2019-06-01"
    ],
    "hostile": [
      "src_ip"
    ],
    "cvss_v3_base": [
      "7.3"
    ],
    "cwe_id": [
      "20"
    ]
  }
}

Example 2

This metadata keyword in a rule:

metadata:cwe_id 507,malware post-infection,hostile dest_ip,created_at 2016-03-21,updated_at 2016-04-02,
filename acme.rules,priority high,infected src_ip,rule_source acme-rule-factory,attack_target http-client,
attack_target client,mitre_attack t1094,protocols http,protocols tcp;

Results in this in the Suricata EVE JSON log:

{
  "metadata": {
    "protocols": [
      "tcp",
      "http"
    ],
    "mitre_attack": [
      "t1094"
    ],
    "attack_target": [
      "client",
      "http-client"
    ],
    "rule_source": [
      "acme-rule-factory"
    ],
    "infected": [
      "src_ip"
    ],
    "priority": [
      "high"
    ],
    "filename": [
      "acme.rules"
    ],
    "updated_at": [
      "2016-04-02"
    ],
    "created_at": [
      "2016-03-21"
    ],
    "hostile": [
      "dest_ip"
    ],
    "malware": [
      "post-infection"
    ],
    "cwe_id": [
      "507"
    ]
  }
}