{
"type": "object",
+ "additionalProperties": false,
+ "required": [
+ "event_type",
+ "timestamp"
+ ],
"properties": {
"app_proto": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"app_proto_expected": {
"type": "string"
"type": "string"
},
"dest_ip": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"dest_port": {
- "type": "integer",
- "optional": true
+ "type": "integer"
},
"event_type": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"flow_id": {
- "type": "integer",
- "optional": true
+ "type": "integer"
},
"icmp_code": {
"type": "integer"
"type": "string"
},
"pcap_cnt": {
- "type": "integer",
- "optional": true
+ "type": "integer"
},
"pcap_filename": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"pkt_src": {
"type": "string"
},
"proto": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"response_icmp_code": {
"type": "integer"
"type": "integer"
},
"src_ip": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"src_port": {
- "type": "integer",
- "optional": true
+ "type": "integer"
},
"stream": {
"type": "integer"
},
"timestamp": {
"type": "string",
- "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+[+\\-]\\d+$",
- "optional": false
+ "pattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}\\.\\d+[+\\-]\\d+$"
},
"direction": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"tx_id": {
- "type": "integer",
- "optional": true
+ "type": "integer"
},
"files": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
- "optional": true,
+ "additionalProperties": false,
"properties": {
"end": {
"type": "integer"
"type": "integer"
}
}
- },
- "additionalProperties": false
+ }
}
},
"vlan": {
},
"alert": {
"type": "object",
- "optional": true,
"properties": {
"action": {
"type": "string"
},
"stream_tcp": {
"type": "object",
- "optional": true,
"additionalProperties": true
},
"anomaly": {
"type": "object",
- "optional": true,
"properties": {
"app_proto": {
"type": "string"
},
"bittorrent_dht": {
"type": "object",
- "optional": true,
"properties": {
"transaction_id": {
"type": "string"
"request": {
"type": "object",
"additionalProperties": false,
- "optional": true,
"properties": {
"id": {
"type": "string"
},
"target": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"implied_port": {
"type": "integer"
},
"info_hash": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"port": {
"type": "integer"
},
"token": {
- "type": "string",
- "optional": true
+ "type": "string"
}
}
},
"response": {
"type": "object",
"additionalProperties": false,
- "optional": true,
+ "required": ["id"],
"properties": {
"id": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"nodes": {
"type": "array",
- "optional": true,
"items": {
"type": "object",
"items": {
"type": "object",
"additionalProperties": false,
+ "required": [
+ "id",
+ "ip",
+ "port"
+ ],
"properties": {
"id": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"ip": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"port": {
- "type": "number",
- "optional": false
+ "type": "number"
}
}
}
},
"nodes6": {
"type": "array",
- "optional": true,
"items": {
"type": "object",
"additionalProperties": false,
+ "required": [
+ "id",
+ "ip",
+ "port"
+ ],
"properties": {
"id": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"ip": {
- "type": "string",
- "optional": false
+ "type": "string"
},
"port": {
- "type": "number",
- "optional": false
+ "type": "number"
}
}
}
},
"token": {
- "type": "string",
- "optional": true
+ "type": "string"
},
"values": {
"type": "array",
- "optional": true,
"items": {
"type": "object"
}
},
"error": {
"type": "object",
- "optional": true,
"additionalProperties": false,
"properties": {
"num": {
},
"dcerpc": {
"type": "object",
- "optional": true,
"properties": {
"activityuuid": {
"type": "string"
},
"req": {
"type": "object",
- "optional": true,
"properties": {
"frag_cnt": {
"type": "integer"
},
"res": {
"type": "object",
- "optional": true,
"properties": {
"frag_cnt": {
"type": "integer"
},
"dhcp": {
"type": "object",
- "optional": true,
"properties": {
"assigned_ip": {
"type": "string"
},
"dnp3": {
"type": "object",
- "optional": true,
"properties": {
"dst": {
"type": "integer"
},
"dns": {
"type": "object",
- "optional": true,
"properties": {
"aa": {
"type": "boolean"
"minItems": 1,
"items": {
"type": "object",
- "optional": true,
"properties": {
"rdata": {
"type": "string"
},
"srv": {
"type": "object",
- "optional": true,
"properties": {
"name": {
"type": "string"
"minItems": 1,
"items": {
"type": "object",
- "optional": true,
"properties": {
"rdata": {
"type": "string"
},
"soa": {
"type": "object",
- "optional": true,
"properties": {
"expire": {
"type": "integer"
"minItems": 1,
"items": {
"type": "object",
- "optional": true,
"properties": {
"id": {
"type": "integer"
},
"grouped": {
"type": "object",
- "optional": true,
"properties": {
"A": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
- "optional": true,
"properties": {
"name": {
"type": "string"
},
"drop": {
"type": "object",
- "optional": true,
"properties": {
"ack": {
"type": "boolean"
},
"email": {
"type": "object",
- "optional": true,
"properties": {
"body_md5": {
"type": "string"
},
"engine": {
"type": "object",
- "optional": true,
"properties": {
"error": {
"type": "string"
},
"ether": {
"type": "object",
- "optional": true,
"properties": {
"dest_mac": {
"type": "string"
},
"fileinfo": {
"type": "object",
- "optional": true,
"properties": {
"end": {
"type": "integer"
},
"flow": {
"type": "object",
- "optional": true,
"properties": {
"action": {
"type": "string"
},
"bypassed": {
"type": "object",
- "optional": false,
"properties": {
"pkts_toserver": {
"type": "integer"
},
"ftp": {
"type": "object",
- "optional": true,
"properties": {
"command": {
"type": "string"
},
"ftp_data": {
"type": "object",
- "optional": true,
"properties": {
"command": {
"type": "string"
},
"http": {
"type": "object",
- "optional": true,
"properties": {
"hostname": {
"type": "string"
},
"http2": {
"type": "object",
- "optional": true,
"properties": {
"http_method": {
"type": "string"
},
"tcp": {
"type": "object",
- "optional": true,
"properties": {
"ack": {
"type": "boolean"
},
"template": {
"type": "object",
- "optional": true,
"properties": {
"request": {
"type": "string"
},
"tftp": {
"type": "object",
- "optional": true,
"properties": {
"file": {
"type": "string"
},
"tls": {
"type": "object",
- "optional": true,
"properties": {
"client": {
"type": "object",
- "optional": true,
"properties": {
"fingerprint": {
"type": "string"
},
"ja3": {
"type": "object",
- "optional": true,
"properties": {
"hash": {
"type": "string"
},
"ja3s": {
"type": "object",
- "optional": true,
"properties": {
"hash": {
"type": "string"
},
"traffic": {
"type": "object",
- "optional": true,
"properties": {
"id": {
"type": "array",
},
"tunnel": {
"type": "object",
- "optional": true,
"properties": {
"depth": {
"type": "integer"
"additionalProperties": false
}
},
- "additionalProperties": false,
"$defs": {
"stats_applayer_error": {
"type": "object",