Pfelk: Suricata on pfSense 2.5.0 - logs being sent but no logs ingested

[revere521]

Describe the bug
Suricata on pfSense 2.5.0 - logs being sent but no logs ingested

I have followed the instructions to setup Suricata on my LAN interface and Syslog-NG to capture and send logs. I believe everything is setup properly, and tcpdump on my pfelk box shows the logs being delivered, but i have nothing in my pfelk-suricata index.

I suspect there is either a pattern match issue in 01-inputs or 02-types (either the observer type of suricata, the host, or the timestamp). here is some tcpdump output from sudo tcpdump -vvv -A -i any port 5040

If this all looks correct, I can dive into screencaps of my setup:

tcpdump: listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
08:44:47.173855 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 830)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0xd10c (correct), seq 2749745600:2749746378, ack 1813747456, win 514, options [nop,nop,TS val 535454811 ecr 2333999033], length 778
E..>[email protected].\......l..............
..d[....<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:45.993253-0500","flow_id":808231161903439,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":51409,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}

08:44:47.173856 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1500)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [.], cksum 0x9fe2 (correct), seq 778:2226, ack 1, win 514, options [nop,nop,TS val 535454811 ecr 2333999033], length 1448
[email protected].\......l..............
..d[....<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:45.993253-0500","flow_id":808231161903439,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":51409,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:46.637433-0500","flow_id":1785477955762681,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":43700,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":46305,"rrname":"ubuntuserver1.HOME","rrtype":"AAAA","tx_id":0}}
<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:46.637662-0500","flow_id":1785477955762681,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":43700,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":46305,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"ubuntuserve
08:44:47.173902 IP (tos 0x0, ttl 64, id 37052, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x2af4), seq 1, ack 778, win 5948, options [nop,nop,TS val 2334001034 ecr 535454811], length 0
E..4..@.@.&A...u.......\l..........<.......
......d[
08:44:47.173928 IP (tos 0x0, ttl 64, id 37053, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x2553), seq 1, ack 2226, win 5941, options [nop,nop,TS val 2334001034 ecr 535454811], length 0
E..4..@.@.&@...u.......\l......r...5.......
......d[
08:44:47.174143 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1331)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0xf5eb (correct), seq 2226:3505, ack 1, win 514, options [nop,nop,TS val 535454811 ecr 2334001034], length 1279
[email protected].\.....rl..............
..d[....r1.HOME","rrtype":"AAAA","rcode":"NOERROR"}}
<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:46.307453-0500","flow_id":98414566522934,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":23792,"dest_ip":"192.168.1.104","dest_port":8086,"proto":"TCP","http":{"hostname":"192.168.1.104","http_port":8086,"url":"\/write?db=PfSense","http_user_agent":"Telegraf\/1.17.0 Go\/1.15.7","http_method":"POST","protocol":"HTTP\/1.1","length":0},"app_proto":"http","fileinfo":{"filename":"\/write","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1507,"tx_id":359}}
<13>Feb 26 08:44:47 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:46.324549-0500","flow_id":98414566522934,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.1","src_port":23792,"dest_ip":"192.168.1.104","dest_port":8086,"proto":"TCP","tx_id":359,"http":{"hostname":"192.168.1.104","http_port":8086,"url":"\/write?db=PfSense","http_user_agent":"Telegraf\/1.17.0 Go\/1.15.7","http_content_type":"application\/json","accept_encoding":"gzip","authorization":"Basic cGZzZW5zZV9maXJld2FsbF93cml0ZTpHZGQzdmlsMw==","content_type":"application\/json","date":"Fri, 26 Feb 2021 13:44:46 GMT","http_method":"POST","protocol":"HTTP\/1.1","status":204,"length":0}}

08:44:47.174165 IP (tos 0x0, ttl 64, id 37054, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x205b), seq 1, ack 3505, win 5933, options [nop,nop,TS val 2334001035 ecr 535454811], length 0
E..4..@.@.&?...u.......\l......q...-.......
......d[
08:44:48.174178 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 397)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0xbb96 (correct), seq 3505:3850, ack 1, win 514, options [nop,nop,TS val 535455811 ecr 2334001035], length 345
[email protected].\.....ql..............
..hC....<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.176034-0500","flow_id":377321388224418,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":37618,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":35592,"rrname":"117.1.168.192.in-addr.arpa","rrtype":"PTR","tx_id":0}}

08:44:48.174178 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1500)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [.], cksum 0xb72e (correct), seq 3850:5298, ack 1, win 514, options [nop,nop,TS val 535455811 ecr 2334001035], length 1448
[email protected].\......l..............
..hC....<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.177542-0500","flow_id":2023827165918598,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":46800,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":51457,"rrname":"1.1.168.192.in-addr.arpa","rrtype":"PTR","tx_id":0}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.177610-0500","flow_id":2023827165918598,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":46800,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":51457,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"1.1.168.192.in-addr.arpa","rrtype":"PTR","rcode":"NOERROR","answers":[{"rrname":"1.1.168.192.in-addr.arpa","rrtype":"PTR","ttl":3600,"rdata":"pfSense.HOME"}],"grouped":{"PTR":["pfSense.HOME"]}}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.176277-0500","flow_id":377321388224418,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.117","src_port":37618,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":35592,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"117.1.168.192.in-addr.arpa","rrtype":"PTR","rcode":"NOERROR","answers":[{"rrname":"117.1.168.192.in-addr.arpa","rrtype":"PTR","ttl":3600,"rdata":"UBUNTUSERVER1.HOME"}],"grouped":{"PTR":["UBUNT
08:44:48.174178 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1500)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [.], cksum 0x7a08 (correct), seq 5298:6746, ack 1, win 514, options [nop,nop,TS val 535455811 ecr 2334001035], length 1448
[email protected].\.....rl.......z......
..hC....USERVER1.HOME"]}}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.467178-0500","flow_id":2037008420511978,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":37486,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":21257,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.467338-0500","flow_id":2037008420511978,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":37486,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":21257,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":28,"rdata":"54.210.227.170"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":28,"rdata":"54.88.253.164"}],"grouped":{"A":["54.210.227.170","54.88.253.164"]}}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.471556-0500","flow_id":2037008420511978,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":37486,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":12383,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.471622-0500","flow_id":2037008420511978,"in_iface":"re0
08:44:48.174234 IP (tos 0x0, ttl 64, id 37055, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x1723), seq 1, ack 3850, win 5948, options [nop,nop,TS val 2334002035 ecr 535455811], length 0
E..4..@.@.&>...u.......\l..........<.......
...s..hC
08:44:48.174267 IP (tos 0x0, ttl 64, id 37056, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x1182), seq 1, ack 5298, win 5941, options [nop,nop,TS val 2334002035 ecr 535455811], length 0
E..4..@.@.&=...u.......\l......r...5.......
...s..hC
08:44:48.174274 IP (tos 0x0, ttl 64, id 37057, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x0be2), seq 1, ack 6746, win 5933, options [nop,nop,TS val 2334002035 ecr 535455811], length 0
E..4..@.@.&<...u.......\l..........-.......
...s..hC
08:44:48.174441 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 1125)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0x00c2 (correct), seq 6746:7819, ack 1, win 514, options [nop,nop,TS val 535455811 ecr 2334002035], length 1073
[email protected].\......l..............
..hC...s","event_type":"dns","src_ip":"192.168.1.115","src_port":37486,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":12383,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":558}]}}
<13>Feb 26 08:44:48 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:47.610918-0500","flow_id":1834384748398559,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":54226,"dest_ip":"54.210.227.170","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}

08:44:48.174462 IP (tos 0x0, ttl 64, id 37058, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0x07a2), seq 1, ack 7819, win 5948, options [nop,nop,TS val 2334002035 ecr 535455811], length 0
E..4..@.@.&;...u.......\l......K...<.......
...s..hC
08:44:51.181876 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 831)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0x2749 (correct), seq 7819:8598, ack 1, win 514, options [nop,nop,TS val 535458819 ecr 2334002035], length 779
[email protected].\.....Kl.......'I.....
..t....s<13>Feb 26 08:44:51 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:49.760335-0500","flow_id":1457136296086428,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":65197,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}

08:44:51.181926 IP (tos 0x0, ttl 64, id 37059, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0xed17), seq 1, ack 8598, win 5948, options [nop,nop,TS val 2334005042 ecr 535458819], length 0
E..4..@.@.&:...u.......\l......V...<.......
...2..t.
08:44:51.182132 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 792)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0xa5b9 (correct), seq 8598:9338, ack 1, win 514, options [nop,nop,TS val 535458819 ecr 2334005042], length 740
[email protected].\.....Vl..............
..t....2<13>Feb 26 08:44:51 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:49.760335-0500","flow_id":1457136296086428,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":65197,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}

08:44:51.182147 IP (tos 0x0, ttl 64, id 37060, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0xea32), seq 1, ack 9338, win 5948, options [nop,nop,TS val 2334005043 ecr 535458819], length 0
E..4..@.@.&9...u.......\l......:...<.......
...3..t.
08:44:53.183712 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto TCP (6), length 720)
    pfSense.HOME.4700 > UBUNTUSERVER1.HOME.5040: Flags [P.], cksum 0x9f74 (correct), seq 9338:10006, ack 1, win 514, options [nop,nop,TS val 535460821 ecr 2334005043], length 668
[email protected].\.....:l........t.....
..{....3<13>Feb 26 08:44:53 pfSense.HOME suricata: {"timestamp":"2021-02-26T08:44:52.234895-0500","flow_id":1449985175766563,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.195","src_port":62200,"dest_ip":"52.114.142.206","dest_port":443,"proto":"TCP","tls":{"subject":"CN=presence.teams.microsoft.com","issuerdn":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02","serial":"7F:00:01:63:71:D6:B2:E6:2B:73:F5:7D:42:00:00:00:01:63:71","fingerprint":"ae:89:1c:e1:42:98:ec:d8:13:00:3b:9f:2d:94:7a:3c:fe:a9:ff:0f","sni":"noam.presence.teams.microsoft.com","version":"TLS 1.2","notbefore":"2020-10-23T19:37:56","notafter":"2021-10-23T19:37:56","ja3":{},"ja3s":{}}}

08:44:53.183741 IP (tos 0x0, ttl 64, id 37061, offset 0, flags [DF], proto TCP (6), length 52)
    UBUNTUSERVER1.HOME.5040 > pfSense.HOME.4700: Flags [.], cksum 0x83ed (incorrect -> 0xd7f3), seq 1, ack 10006, win 5948, options [nop,nop,TS val 2334007044 ecr 535460821], length 0
E..4..@.@.&8...u.......\l..........<.......
......{.

[revere521]

everything else (firewall, dhcp and unbound are working fine)

[a3ilson]

@revere521 - are you using syslog-ng to send all other logs? or just Suricata?

Based on the provided messages, the error appears to be the initial GROK filter within the 03-filter.conf file:

The provided logs:
<13>Feb 26 08:44:53 pfSense.HOME suricata: ...
vs
<174>Feb 26 08:38:33 OPNsense.HOME suricata[13033]: ...

Note that the process id is omitted.

[a3ilson]

@revere521 - Here's a solution that'll parse those logs and I've tested on my setup without any issues so far.

update 03-filter.conf line 12 to the following:

match => {"message" => " %{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\s*?(\[)?%{POSINT:[process][pid]}(\]:)?\s*(\-\s*\-)?\s*%{GREEDYDATA:filter_message}|%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}%{GREEDYDATA:filter_message}"}

I am contemplating revising the 03-filter.conf file, to reference these GROK patterns via pfelk.grok

I also noted that your provided suricata logs appear to be alerts rather than the full suricata messages.

[revere521]

I added the test Grok in my 03-filter - good catch on the process ID.
I am using the program-override setting in the source settings for Syslog-NG - which may remove the pid. I also may not have everything turned on in the Suricata settings as far as what is captured. In Suricata 6.0, some things look different than what you instructions seem to suggest. If i have some time later - i will screencap everything i have set - and maybe you can provide some guidance.

[a3ilson]

Thanks! OPNsense is still sporting suricata v5 😞 but the outputs haven't changed much and are in a JSON format making it much easier to ingest/enrich than say openvpn.

No rush and feel free to tinker with the settings and perhaps eliminate the piped grok pattern (if the process id is configurable).

[revere521]

I think it may be stumbling on a colon here:

Test data:

Feb 26 10:10:22 pfSense suricata: {"timestamp":"2021-02-26T10:10:21.248655-0500","flow_id":1053315217327076,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":52390,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}

your grok pattern from above:

%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\s*?(\[)?%{POSINT:[process][pid]}(\]:)?\s*(\-\s*\-)?\s*%{GREEDYDATA:filter_message}|%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}%{GREEDYDATA:filter_message}

the Output in the debugger:

{
  "[event][created]": "Feb 26 10:10:22",
  "[host][name]": "pfSense",
  "filter_message": " {\"timestamp\":\"2021-02-26T10:10:21.248655-0500\",\"flow_id\":1053315217327076,\"in_iface\":\"re0\",\"event_type\":\"fileinfo\",\"src_ip\":\"192.168.254.254\",\"src_port\":80,\"dest_ip\":\"192.168.1.101\",\"dest_port\":52390,\"proto\":\"TCP\",\"http\":{\"hostname\":\"192.168.254.254\",\"url\":\"\\/cgi-bin\\/bannerstate.ha\",\"http_user_agent\":\"Mozilla\\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\\/20100101 Firefox\\/85.0\",\"http_content_type\":\"text\\/html\",\"http_refer\":\"http:\\/\\/192.168.254.254\\/cgi-bin\\/home.ha\",\"http_method\":\"GET\",\"protocol\":\"HTTP\\/1.1\",\"status\":200,\"length\":1716},\"app_proto\":\"http\",\"fileinfo\":{\"filename\":\"\\/cgi-bin\\/bannerstate.ha\",\"sid\":[],\"gaps\":false,\"state\":\"CLOSED\",\"stored\":false,\"size\":1716,\"tx_id\":0}}",
  "[process][name]": "suricata:"
}

I'm looking to see if there is any change i can make to that pattern to remove the colon

[a3ilson]

You are correct... I thought I added that (escaping :)

Update to:

%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\s*?(\[)?%{POSINT:[process][pid]}(\]:)?\s*(\-\s*\-)?\s*%{GREEDYDATA:filter_message}|%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\:%{GREEDYDATA:filter_message}

[revere521]

Beat me to it, and yes now i do get data into the index, but they are all grokparsefailures.

still progress

here is a screencap (if the fields available help us understand where it stops parsing) - i will paste a list of the original messages below

<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T917-0500","flow_id":1800658958741569,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52623,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"ssl.google-analytics.com","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T759-0500","flow_id":1674713337728771,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":43426,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":63780,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"ssl.google-analytics.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ssl.google-analytics.com","rrtype":"A","ttl":60,"rdata":"10.10.10.1"}],"grouped":{"A":["10.10.10.1"]}}}

<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T838-0500","flow_id":23979164721823,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.165","src_port":50828,"dest_ip":"172.217.10.234","dest_port":443,"proto":"TCP","tls":{"sni":"www.googleapis.com","version":"TLS 1.3","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T106-0500","flow_id":1475403232844270,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52625,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"ssl.google-analytics.com","version":"TLSv1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T225-0500","flow_id":2104409783330312,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52624,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"ssl.google-analytics.com","version":"TLS 1.1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T952-0500","flow_id":903219099751612,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":2189,"dest_ip":"192.168.1.102","dest_port":10504,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":263},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":263,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T952-0500","flow_id":903219099751612,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.102","src_port":10504,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","accept_encoding":"deflate","connection":"close","content_length":"263","content_type":"text\/xml; charset=\"utf-8\"","server":"FreeBSD\/12.2-STABLE UPnP\/1.1 MiniUPnPd\/2.2.1","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":263}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T678-0500","flow_id":2132082257608053,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.102","src_port":10506,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_method":"POST","protocol":"HTTP\/1.1","length":0},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":559,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T984-0500","flow_id":1354806993656822,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":2189,"dest_ip":"192.168.1.102","dest_port":10505,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":536},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":536,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T458-0500","flow_id":1115285257500461,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":14195,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":44422,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"www.googleapis.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.10.234"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.10.42"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"142.250.80.10"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.11.10"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.10.138"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.3.106"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"142.250.64.74"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.12.202"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.12.170"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.165.138"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.9.234"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"142.250.64.106"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.6.202"},{"rrname":"www.googleapis.com","rrtype":"A","ttl":100,"rdata":"172.217.10.106"}],"grouped":{"A":["172.217.10.234","172.217.10.42","142.250.80.10","172.217.11.10","172.217.10.138","172.217.3.106","142.250.64.74","172.217.12.202","172.217.12.170","172.217.165.138","172.217.9.234","142.250.64.106","172.217.6.202","172.217.10.106"]}}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T995-0500","flow_id":2132082257608053,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":2189,"dest_ip":"192.168.1.102","dest_port":10506,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":263},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":263,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T507-0500","flow_id":1674713337728771,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":43426,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":63780,"rrname":"ssl.google-analytics.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T984-0500","flow_id":1354806993656822,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.102","src_port":10505,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","accept_encoding":"deflate","connection":"close","content_length":"536","content_type":"text\/xml; charset=\"utf-8\"","server":"FreeBSD\/12.2-STABLE UPnP\/1.1 MiniUPnPd\/2.2.1","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":536}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T663-0500","flow_id":1354806993656822,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.102","src_port":10505,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_method":"POST","protocol":"HTTP\/1.1","length":0},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":364,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T995-0500","flow_id":2132082257608053,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.102","src_port":10506,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","accept_encoding":"deflate","connection":"close","content_length":"263","content_type":"text\/xml; charset=\"utf-8\"","server":"FreeBSD\/12.2-STABLE UPnP\/1.1 MiniUPnPd\/2.2.1","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":263}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T501-0500","flow_id":1115285257500461,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":14195,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":44422,"rrname":"www.googleapis.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T960-0500","flow_id":1233772667733948,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.102","src_port":10507,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","accept_encoding":"deflate","connection":"close","content_length":"536","content_type":"text\/xml; charset=\"utf-8\"","server":"FreeBSD\/12.2-STABLE UPnP\/1.1 MiniUPnPd\/2.2.1","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":536}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T670-0500","flow_id":1233772667733948,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.102","src_port":10507,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_method":"POST","protocol":"HTTP\/1.1","length":0},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":364,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T960-0500","flow_id":1233772667733948,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":2189,"dest_ip":"192.168.1.102","dest_port":10507,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_content_type":"text\/xml","http_method":"POST","protocol":"HTTP\/1.1","status":200,"length":536},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":536,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T985-0500","flow_id":951533186861040,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.102","src_port":10503,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/rootDesc.xml","http_content_type":"text\/xml","accept_encoding":"deflate","accept_language":"en","connection":"close","content_language":"en","content_length":"2591","content_type":"text\/xml; charset=\"utf-8\"","server":"FreeBSD\/12.2-STABLE UPnP\/1.1 MiniUPnPd\/2.2.1","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":2591}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T668-0500","flow_id":903219099751612,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.102","src_port":10504,"dest_ip":"192.168.1.1","dest_port":2189,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/ctl\/IPConn","http_method":"POST","protocol":"HTTP\/1.1","length":0},"app_proto":"http","fileinfo":{"filename":"\/ctl\/IPConn","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":559,"tx_id":0}}
<13>Feb 26 10:36:57 pfSense suricata: {"timestamp":"2021-02-26T985-0500","flow_id":951533186861040,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.1.1","src_port":2189,"dest_ip":"192.168.1.102","dest_port":10503,"proto":"TCP","http":{"hostname":"192.168.1.1","http_port":2189,"url":"\/rootDesc.xml","http_content_type":"text\/xml","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":2591},"app_proto":"http","fileinfo":{"filename":"\/rootDesc.xml","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":2591,"tx_id":0}}
<13>Feb 26 10:36:56 pfSense suricata: {"timestamp":"2021-02-26T894-0500","flow_id":699729991671319,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":56478,"dest_ip":"54.88.253.164","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:56 pfSense suricata: {"timestamp":"2021-02-26T832-0500","flow_id":205039953465381,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":52627,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":60138,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 10:36:56 pfSense suricata: {"timestamp":"2021-02-26T799-0500","flow_id":205039953465381,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":52627,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":35341,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":6,"rdata":"54.88.253.164"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":6,"rdata":"54.210.227.170"}],"grouped":{"A":["54.88.253.164","54.210.227.170"]}}}
<13>Feb 26 10:36:56 pfSense suricata: {"timestamp":"2021-02-26T589-0500","flow_id":205039953465381,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":52627,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":35341,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:56 pfSense suricata: {"timestamp":"2021-02-26T717-0500","flow_id":205039953465381,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":52627,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":60138,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":436}]}}
<13>Feb 26 10:36:55 pfSense suricata: {"timestamp":"2021-02-26T283-0500","flow_id":1478542853858219,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":10126,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":9658,"rrname":"app-measurement.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:55 pfSense suricata: {"timestamp":"2021-02-26T495-0500","flow_id":969945711571894,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.165","src_port":51525,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"app-measurement.com","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:55 pfSense suricata: {"timestamp":"2021-02-26T829-0500","flow_id":1478542853858219,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":10126,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":9658,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"app-measurement.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"app-measurement.com","rrtype":"A","ttl":60,"rdata":"10.10.10.1"}],"grouped":{"A":["10.10.10.1"]}}}
<13>Feb 26 10:36:54 pfSense suricata: {"timestamp":"2021-02-26T515-0500","flow_id":404440252534093,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50235,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:54 pfSense suricata: {"timestamp":"2021-02-26T515-0500","flow_id":404440252534093,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50235,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:52 pfSense suricata: {"timestamp":"2021-02-26T408-0500","flow_id":1616561627701072,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":65535,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":4192,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"hopkins.remotewebaccess.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"hopkins.remotewebaccess.com","rrtype":"A","ttl":300,"rdata":"156.146.54.52"}],"grouped":{"A":["156.146.54.52"]}}}
<13>Feb 26 10:36:52 pfSense suricata: {"timestamp":"2021-02-26T463-0500","flow_id":1095919249652653,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53738,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:52 pfSense suricata: {"timestamp":"2021-02-26T463-0500","flow_id":1095919249652653,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53738,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:52 pfSense suricata: {"timestamp":"2021-02-26T536-0500","flow_id":1616561627701072,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":65535,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":4192,"rrname":"hopkins.remotewebaccess.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:52 pfSense suricata: {"timestamp":"2021-02-26T861-0500","flow_id":1836051636354465,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":53384,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":42608,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"dyndns.domains.live.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"dyndns.domains.live.com","rrtype":"CNAME","ttl":370,"rdata":"wssddnsservice.cloudapp.net"},{"rrname":"wssddnsservice.cloudapp.net","rrtype":"A","ttl":51,"rdata":"70.37.77.92"}],"grouped":{"A":["70.37.77.92"],"CNAME":["wssddnsservice.cloudapp.net"]}}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T953-0500","flow_id":1168111207260855,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":63755,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":46220,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"go.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"go.microsoft.com","rrtype":"CNAME","ttl":3141,"rdata":"go.microsoft.com.edgekey.net"},{"rrname":"go.microsoft.com.edgekey.net","rrtype":"CNAME","ttl":113,"rdata":"e11290.dspg.akamaiedge.net"},{"rrname":"e11290.dspg.akamaiedge.net","rrtype":"A","ttl":20,"rdata":"23.73.246.80"}],"grouped":{"A":["23.73.246.80"],"CNAME":["go.microsoft.com.edgekey.net","e11290.dspg.akamaiedge.net"]}}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T264-0500","flow_id":373376901379330,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.109","src_port":58156,"dest_ip":"23.73.246.80","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=WA, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=go.microsoft.com","issuerdn":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 01","serial":"6B:00:06:99:71:4B:62:8E:78:C9:4D:3D:00:00:00:00:06:99:71","fingerprint":"88:c7:2f:7b:17:dd:89:49:46:0b:a2:3f:1b:26:80:82:24:cf:0b:58","sni":"go.microsoft.com","version":"TLSv1","notbefore":"2021-01-07T21:45:54","notafter":"2022-01-07T21:45:54","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T730-0500","flow_id":1836051636354465,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":53384,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":42608,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"dyndns.domains.live.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"dyndns.domains.live.com","rrtype":"CNAME","ttl":371,"rdata":"wssddnsservice.cloudapp.net"},{"rrname":"wssddnsservice.cloudapp.net","rrtype":"A","ttl":52,"rdata":"70.37.77.92"}],"grouped":{"A":["70.37.77.92"],"CNAME":["wssddnsservice.cloudapp.net"]}}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T145-0500","flow_id":1836051636354465,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":53384,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":42608,"rrname":"dyndns.domains.live.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T306-0500","flow_id":1836051636354465,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":53384,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":42608,"rrname":"dyndns.domains.live.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T932-0500","flow_id":18904660462831,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.109","src_port":58157,"dest_ip":"70.37.77.92","dest_port":443,"proto":"TCP","tls":{"subject":"CN=dyndns.domains.live.com","issuerdn":"C=US, O=Microsoft Corporation, CN=Microsoft RSA TLS CA 02","serial":"7F:00:04:53:BB:9A:92:C2:18:3F:73:9D:DF:00:00:00:04:53:BB","fingerprint":"7f:ff:72:14:91:10:9e:57:35:b3:db:3c:85:52:0a:58:8d:9f:1b:3c","sni":"dyndns.domains.live.com","version":"TLSv1","notbefore":"2020-12-09T20:30:35","notafter":"2021-12-09T20:30:35","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T018-0500","flow_id":1168111207260855,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":63755,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":46220,"rrname":"go.microsoft.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T391-0500","flow_id":1168111207260855,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":63755,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":46220,"rrname":"go.microsoft.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:51 pfSense suricata: {"timestamp":"2021-02-26T943-0500","flow_id":1168111207260855,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.109","src_port":63755,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":46220,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"go.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"go.microsoft.com","rrtype":"CNAME","ttl":3141,"rdata":"go.microsoft.com.edgekey.net"},{"rrname":"go.microsoft.com.edgekey.net","rrtype":"CNAME","ttl":113,"rdata":"e11290.dspg.akamaiedge.net"},{"rrname":"e11290.dspg.akamaiedge.net","rrtype":"A","ttl":20,"rdata":"23.73.246.80"}],"grouped":{"A":["23.73.246.80"],"CNAME":["go.microsoft.com.edgekey.net","e11290.dspg.akamaiedge.net"]}}}
<13>Feb 26 10:36:50 pfSense suricata: {"timestamp":"2021-02-26T495-0500","flow_id":431981730019790,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.101","src_port":53736,"dest_ip":"142.250.64.106","dest_port":443,"proto":"TCP","tls":{"sni":"safebrowsing.googleapis.com","version":"TLS 1.3","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:50 pfSense suricata: {"timestamp":"2021-02-26T053-0500","flow_id":1008662693908061,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":21210,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":42640,"rrname":"ssl.google-analytics.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:50 pfSense suricata: {"timestamp":"2021-02-26T767-0500","flow_id":1008662693908061,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.165","src_port":21210,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":42640,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"ssl.google-analytics.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ssl.google-analytics.com","rrtype":"A","ttl":60,"rdata":"10.10.10.1"}],"grouped":{"A":["10.10.10.1"]}}}
<13>Feb 26 10:36:50 pfSense suricata: {"timestamp":"2021-02-26T115-0500","flow_id":367166378583901,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.165","src_port":51523,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"ssl.google-analytics.com","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:44 pfSense suricata: {"timestamp":"2021-02-26T403-0500","flow_id":1842025935386982,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50234,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:44 pfSense suricata: {"timestamp":"2021-02-26T403-0500","flow_id":1842025935386982,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50234,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T450-0500","flow_id":2228362538557898,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52622,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLSv1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T162-0500","flow_id":23328476288421,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.192","src_port":64210,"dest_ip":"52.114.76.34","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=WA, L=Redmond, O=Microsoft, OU=WSE, CN=*.events.data.microsoft.com","issuerdn":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Secure Server CA 2011","serial":"33:00:00:01:94:03:FC:70:4C:4A:6B:63:A3:00:00:00:00:01:94","fingerprint":"82:31:53:dc:37:2b:97:a5:68:ac:5e:78:25:04:06:c4:65:f6:1c:4d","sni":"eu-v20.events.data.microsoft.com","version":"TLS 1.2","notbefore":"2020-09-10T19:03:31","notafter":"2021-12-10T19:03:31","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T819-0500","flow_id":95580563583442,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52621,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T423-0500","flow_id":1847882123183603,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52620,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T934-0500","flow_id":1647427409564109,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":61237,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":21183,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"eu-v20.events.data.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"eu-v20.events.data.microsoft.com","rrtype":"CNAME","ttl":3236,"rdata":"eu.events.data.trafficmanager.net"},{"rrname":"eu.events.data.trafficmanager.net","rrtype":"CNAME","ttl":53,"rdata":"skypedataprdcolneu02.cloudapp.net"},{"rrname":"skypedataprdcolneu02.cloudapp.net","rrtype":"A","ttl":10,"rdata":"52.114.76.34"}],"grouped":{"CNAME":["eu.events.data.trafficmanager.net","skypedataprdcolneu02.cloudapp.net"],"A":["52.114.76.34"]}}}
<13>Feb 26 10:36:43 pfSense suricata: {"timestamp":"2021-02-26T944-0500","flow_id":1647427409564109,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":61237,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":21183,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"eu-v20.events.data.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"eu-v20.events.data.microsoft.com","rrtype":"CNAME","ttl":3236,"rdata":"eu.events.data.trafficmanager.net"},{"rrname":"eu.events.data.trafficmanager.net","rrtype":"CNAME","ttl":53,"rdata":"skypedataprdcolneu02.cloudapp.net"},{"rrname":"skypedataprdcolneu02.cloudapp.net","rrtype":"A","ttl":10,"rdata":"52.114.76.34"}],"grouped":{"A":["52.114.76.34"],"CNAME":["eu.events.data.trafficmanager.net","skypedataprdcolneu02.cloudapp.net"]}}}
<13>Feb 26 10:36:42 pfSense suricata: {"timestamp":"2021-02-26T438-0500","flow_id":1647427409564109,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":61237,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":21183,"rrname":"eu-v20.events.data.microsoft.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:36:42 pfSense suricata: {"timestamp":"2021-02-26T643-0500","flow_id":367499237990880,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53731,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:42 pfSense suricata: {"timestamp":"2021-02-26T643-0500","flow_id":367499237990880,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53731,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:42 pfSense suricata: {"timestamp":"2021-02-26T477-0500","flow_id":1647427409564109,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":61237,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":21183,"rrname":"eu-v20.events.data.microsoft.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:41 pfSense suricata: {"timestamp":"2021-02-26T535-0500","flow_id":959008576398293,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":51406,"dest_ip":"163.171.139.179","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Campbell, O=CDNetworks Inc., CN=support100.cdnetworks.net","issuerdn":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","serial":"06:6F:72:DD:26:BF:18:56:95:5F:39:AB:1B:7E:D3:5E","fingerprint":"57:b3:2d:fb:e9:bf:08:08:cb:a4:4f:6f:1f:cd:ed:9c:fc:59:85:12","sni":"us-odc.samsungapps.com","version":"TLS 1.2","notbefore":"2021-02-05T00:00:00","notafter":"2022-03-01T23:59:59","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:40 pfSense suricata: {"timestamp":"2021-02-26T774-0500","flow_id":2206099575399586,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":7967,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":52736,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"us-odc.samsungapps.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"us-odc.samsungapps.com","rrtype":"CNAME","ttl":44,"rdata":"us-odc.gw.samsungapps.com"},{"rrname":"us-odc.gw.samsungapps.com","rrtype":"CNAME","ttl":165,"rdata":"us-odc.samsungapps.com.gslb.cdnetworks.net"},{"rrname":"us-odc.samsungapps.com.gslb.cdnetworks.net","rrtype":"CNAME","ttl":94,"rdata":"us-odc.samsungapps.com.cdngc.net"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":21,"rdata":"163.171.139.179"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":21,"rdata":"163.171.138.222"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":21,"rdata":"157.185.163.121"}],"grouped":{"CNAME":["us-odc.gw.samsungapps.com","us-odc.samsungapps.com.gslb.cdnetworks.net","us-odc.samsungapps.com.cdngc.net"],"A":["163.171.139.179","163.171.138.222","157.185.163.121"]}}}
<13>Feb 26 10:36:40 pfSense suricata: {"timestamp":"2021-02-26T034-0500","flow_id":2206099575399586,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":7967,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":52736,"rrname":"us-odc.samsungapps.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:39 pfSense suricata: {"timestamp":"2021-02-26T683-0500","flow_id":1321263297886189,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":44562,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":15152,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 10:36:39 pfSense suricata: {"timestamp":"2021-02-26T728-0500","flow_id":1321263297886189,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":44562,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":15152,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":453}]}}
<13>Feb 26 10:36:39 pfSense suricata: {"timestamp":"2021-02-26T785-0500","flow_id":1321263297886189,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":44562,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":51003,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":23,"rdata":"54.210.227.170"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":23,"rdata":"54.88.253.164"}],"grouped":{"A":["54.210.227.170","54.88.253.164"]}}}
<13>Feb 26 10:36:39 pfSense suricata: {"timestamp":"2021-02-26T205-0500","flow_id":1321263297886189,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":44562,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":51003,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:39 pfSense suricata: {"timestamp":"2021-02-26T381-0500","flow_id":127462105598353,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":55008,"dest_ip":"54.210.227.170","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:37 pfSense suricata: {"timestamp":"2021-02-26T933-0500","flow_id":316621055088561,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":55794,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":51821,"rrname":"europe.cp.wd.microsoft.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:36:37 pfSense suricata: {"timestamp":"2021-02-26T388-0500","flow_id":2118587469029553,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.192","src_port":64209,"dest_ip":"51.144.227.73","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, OU=Microsoft Corporation, CN=wdcp.microsoft.com","issuerdn":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Secure Server CA 2011","serial":"33:00:00:01:A1:14:D9:A2:E0:18:F6:64:D8:00:00:00:00:01:A1","fingerprint":"81:41:67:66:7e:a9:1b:aa:61:3d:de:d1:41:e7:17:13:ce:c4:3b:22","sni":"europe.cp.wd.microsoft.com","version":"TLS 1.2","notbefore":"2020-12-10T19:38:28","notafter":"2022-03-10T19:38:28","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:37 pfSense suricata: {"timestamp":"2021-02-26T846-0500","flow_id":316621055088561,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":55794,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":51821,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"europe.cp.wd.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"europe.cp.wd.microsoft.com","rrtype":"CNAME","ttl":3557,"rdata":"wd-prod-cp-eu.trafficmanager.net"},{"rrname":"wd-prod-cp-eu.trafficmanager.net","rrtype":"CNAME","ttl":300,"rdata":"wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com"},{"rrname":"wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com","rrtype":"A","ttl":3,"rdata":"13.69.131.175"}],"grouped":{"CNAME":["wd-prod-cp-eu.trafficmanager.net","wd-prod-cp-eu-north-2-fe.northeurope.cloudapp.azure.com"],"A":["13.69.131.175"]}}}
<13>Feb 26 10:36:37 pfSense suricata: {"timestamp":"2021-02-26T802-0500","flow_id":316621055088561,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":55794,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":51821,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"europe.cp.wd.microsoft.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"europe.cp.wd.microsoft.com","rrtype":"CNAME","ttl":3557,"rdata":"wd-prod-cp-eu.trafficmanager.net"},{"rrname":"wd-prod-cp-eu.trafficmanager.net","rrtype":"CNAME","ttl":300,"rdata":"wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com"},{"rrname":"wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com","rrtype":"A","ttl":9,"rdata":"51.144.227.73"}],"grouped":{"A":["51.144.227.73"],"CNAME":["wd-prod-cp-eu.trafficmanager.net","wd-prod-cp-eu-west-2-fe.westeurope.cloudapp.azure.com"]}}}
<13>Feb 26 10:36:37 pfSense suricata: {"timestamp":"2021-02-26T737-0500","flow_id":316621055088561,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":55794,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":51821,"rrname":"europe.cp.wd.microsoft.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:35 pfSense suricata: {"timestamp":"2021-02-26T968-0500","flow_id":1868156515813612,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":40279,"dest_ip":"142.250.64.65","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.googleusercontent.com","issuerdn":"C=US, O=Google Trust Services, CN=GTS CA 1O1","serial":"35:7C:35:B2:8D:F8:60:8D:05:00:00:00:00:87:4A:55","fingerprint":"23:4f:49:40:e5:8c:06:0d:a8:8a:7f:66:99:59:0a:fa:5f:13:e2:90","sni":"mail-attachment.googleusercontent.com","version":"TLS 1.2","notbefore":"2021-01-26T09:05:02","notafter":"2021-04-20T09:05:01","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:35 pfSense suricata: {"timestamp":"2021-02-26T356-0500","flow_id":1307315391308686,"in_iface":"re0","event_type":"alert","src_ip":"192.168.1.192","src_port":64206,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013933,"rev":5,"signature":"ET POLICY HTTP traffic on port 443 (CONNECT)","category":"Potentially Bad Traffic","severity":2,"metadata":{"updated_at":["2020_06_02"],"created_at":["2011_11_17"]}},"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","http_method":"CONNECT","protocol":"HTTP\/1.1","length":0},"app_proto":"http","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":502,"bytes_toclient":361,"start":"2021-02-26T782-0500"},"payload":"Q09OTkVDVCB3d3cuenNjYWxlci5jb206ODAgSFRUUC8xLjENCkhvc3Q6IHd3dy56c2NhbGVyLmNvbTo4MA0KVXNlci1BZ2VudDogV2luZG93cyBNaWNyb3NvZnQgV2luZG93cyAxMCBFbnRlcnByaXNlIFpUdW5uZWwvMS4wDQpQcm94eS1Db25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpYLVpBcHBJbmZvOiA4NzdhZjAwZTFlODRkYzE0OTE1M2UyNWVmMjE5OTczMTkxY2VjMTBlNjJmMmE2OGZjOTBlYmJhZWIyZjk1MmExDQoNCg==","payload_printable":"CONNECT www.zscaler.com:80 HTTP\/1.1\r\nHost: www.zscaler.com:80\r\nUser-Agent: Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nX-ZAppInfo: 877af00e1e84dc149153e25ef219973191cec10e62f2a68fc90ebbaeb2f952a1\r\n\r\n","stream":1,"packet":"NOiU3oIMmCmmghHNCABFAAAolT5AAIAG1izAqAHApeEnG\/rOAbszsynHOeTftFARAgKqzwAAAAAAAAAA","packet_info":{"linktype":1}}
<13>Feb 26 10:36:35 pfSense suricata: {"timestamp":"2021-02-26T004-0500","flow_id":1307315391308686,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64206,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","content_length":"0","proxy_authenticate":"Digest realm=\"zscloud.net\", qop=\"auth\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\"","server":"Zscaler proxy","http_method":"CONNECT","protocol":"HTTP\/1.1","status":407,"length":0}}
<13>Feb 26 10:36:35 pfSense suricata: {"timestamp":"2021-02-26T308-0500","flow_id":532413096838823,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64207,"dest_ip":"165.225.39.27","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","content_length":"0","proxy_authenticate":"Digest realm=\"zscloud.net\", qop=\"auth\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\"","server":"Zscaler proxy","http_method":"CONNECT","protocol":"HTTP\/1.1","status":407,"length":0}}
<13>Feb 26 10:36:35 pfSense suricata: {"timestamp":"2021-02-26T102-0500","flow_id":1190477248492880,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64208,"dest_ip":"165.225.39.27","dest_port":8080,"proto":"TCP","tx_id":0,"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","content_length":"0","proxy_authenticate":"Digest realm=\"zscloud.net\", qop=\"auth\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\"","server":"Zscaler proxy","http_method":"CONNECT","protocol":"HTTP\/1.1","status":407,"length":0}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T938-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"fileinfo","src_ip":"34.107.221.82","src_port":80,"dest_ip":"192.168.1.160","dest_port":57158,"proto":"TCP","http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8},"app_proto":"http","fileinfo":{"filename":"\/success.txt","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":8,"tx_id":2}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T938-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.160","src_port":57158,"dest_ip":"34.107.221.82","dest_port":80,"proto":"TCP","tx_id":2,"http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US","cache_control":"no-cache","pragma":"no-cache","age":"58242","content_length":"8","content_type":"text\/plain","date":"Thu, 25 Feb 2021 23:25:51 GMT","server":"nginx","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T263-0500","flow_id":1900890609077357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":58982,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":42457,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"mail-attachment.googleusercontent.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"mail-attachment.googleusercontent.com","rrtype":"CNAME","ttl":86072,"rdata":"googlehosted.l.googleusercontent.com"},{"rrname":"googlehosted.l.googleusercontent.com","rrtype":"A","ttl":51,"rdata":"142.250.64.65"}],"grouped":{"CNAME":["googlehosted.l.googleusercontent.com"],"A":["142.250.64.65"]}}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T273-0500","flow_id":1145390829256544,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50233,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T869-0500","flow_id":1900890609077357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":58982,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":42457,"rrname":"mail-attachment.googleusercontent.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T273-0500","flow_id":1145390829256544,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50233,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:34 pfSense suricata: {"timestamp":"2021-02-26T592-0500","flow_id":858985230055615,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52123,"dest_ip":"142.250.64.69","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Mountain View, O=Google LLC, CN=mail.google.com","issuerdn":"C=US, O=Google Trust Services, CN=GTS CA 1O1","serial":"08:A6:F6:0A:C2:06:0A:65:03:00:00:00:00:CB:40:A8","fingerprint":"e9:84:a5:6e:6f:10:85:7a:57:de:1b:95:19:d5:1c:94:0d:21:a1:9e","sni":"mail.google.com","version":"TLS 1.2","notbefore":"2021-01-26T09:06:58","notafter":"2021-04-20T09:06:57","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:33 pfSense suricata: {"timestamp":"2021-02-26T298-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.160","src_port":57158,"dest_ip":"34.107.221.82","dest_port":80,"proto":"TCP","tx_id":1,"http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US","cache_control":"no-cache","pragma":"no-cache","age":"58241","content_length":"8","content_type":"text\/plain","date":"Thu, 25 Feb 2021 23:25:51 GMT","server":"nginx","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8}}
<13>Feb 26 10:36:33 pfSense suricata: {"timestamp":"2021-02-26T298-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"fileinfo","src_ip":"34.107.221.82","src_port":80,"dest_ip":"192.168.1.160","dest_port":57158,"proto":"TCP","http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8},"app_proto":"http","fileinfo":{"filename":"\/success.txt","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":8,"tx_id":1}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T403-0500","flow_id":255602454364262,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53723,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T403-0500","flow_id":255602454364262,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53723,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T448-0500","flow_id":1438754275321651,"in_iface":"re0","event_type":"alert","src_ip":"208.54.70.80","src_port":500,"dest_ip":"192.168.1.160","dest_port":59315,"proto":"UDP","tx_id":1,"alert":{"action":"allowed","gid":1,"signature_id":2224003,"rev":1,"signature":"SURICATA IKEv2 weak cryptographic parameters (PRF)","category":"Generic Protocol Command Decode","severity":3},"app_proto":"ikev2","flow":{"pkts_toserver":1,"pkts_toclient":1,"bytes_toserver":376,"bytes_toclient":409,"start":"2021-02-26T939-0500"},"payload":"t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","payload_printable":"..:.#[email protected]..! \" .......o\"..0...,........................................(.........].4. ...z...\".w.-\/....2.cP..(....E=..l.}....@...#.Y........?t!...%P...b..g..q:.6\".gj.D.B..2..L!..N.A.q..I..).V..{... &..]....5)..c...........1.q.|.|.\ny}...CKw....5o......\r1.l..6..]i~s..v..cL.| ..S.s...*H.w...o*.`.).:......2..)[email protected].. .D....\[email protected].\/Y.D.S....-g.","stream":0,"packet":"1FODpT33NOiU3oIMCABFoAGLlAAAADERGvPQNkZQwKgBoAH057MBd745t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","packet_info":{"linktype":1}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T448-0500","flow_id":1438754275321651,"in_iface":"re0","event_type":"alert","src_ip":"208.54.70.80","src_port":500,"dest_ip":"192.168.1.160","dest_port":59315,"proto":"UDP","app_proto":"ikev2","flow":{"pkts_toserver":1,"pkts_toclient":1,"bytes_toserver":376,"bytes_toclient":409,"start":"2021-02-26T939-0500"},"payload":"t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","payload_printable":"..:.#[email protected]..! \" .......o\"..0...,........................................(.........].4. ...z...\".w.-\/....2.cP..(....E=..l.}....@...#.Y........?t!...%P...b..g..q:.6\".gj.D.B..2..L!..N.A.q..I..).V..{... &..]....5)..c...........1.q.|.|.\ny}...CKw....5o......\r1.l..6..]i~s..v..cL.| ..S.s...*H.w...o*.`.).:......2..)[email protected].. .D....\[email protected].\/Y.D.S....-g.","stream":0,"packet":"1FODpT33NOiU3oIMCABFoAGLlAAAADERGvPQNkZQwKgBoAH057MBd745t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","packet_info":{"linktype":1},"tx_id":1,"alert":{"action":"allowed","gid":1,"signature_id":2224004,"rev":2,"signature":"SURICATA IKEv2 weak cryptographic parameters (Auth)","category":"Generic Protocol Command Decode","severity":3}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T448-0500","flow_id":1438754275321651,"in_iface":"re0","event_type":"alert","src_ip":"208.54.70.80","src_port":500,"dest_ip":"192.168.1.160","dest_port":59315,"proto":"UDP","app_proto":"ikev2","flow":{"pkts_toserver":1,"pkts_toclient":1,"bytes_toserver":376,"bytes_toclient":409,"start":"2021-02-26T939-0500"},"payload":"t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","payload_printable":"..:.#[email protected]..! \" .......o\"..0...,........................................(.........].4. ...z...\".w.-\/....2.cP..(....E=..l.}....@...#.Y........?t!...%P...b..g..q:.6\".gj.D.B..2..L!..N.A.q..I..).V..{... &..]....5)..c...........1.q.|.|.\ny}...CKw....5o......\r1.l..6..]i~s..v..cL.| ..S.s...*H.w...o*.`.).:......2..)[email protected].. .D....\[email protected].\/Y.D.S....-g.","stream":0,"packet":"1FODpT33NOiU3oIMCABFoAGLlAAAADERGvPQNkZQwKgBoAH057MBd745t846EiOg7bgBQNn6BWYHFCEgIiAAAAAAAAABbyIAADAAAAAsAQEABAMAAAwBAAAMgA4BAAMAAAgDAAACAwAACAIAAAIAAAAIBAAAAigAAIgAAgAAsRtdpjTvIO3j13r84voi8nfNLS+377T9MhNjUIWtKMfa639FPY8dbKB9wBsEyUDuvhsjmlnurBLnn+qJHD90IazM4yVQnJgCYomXZ+XFcTqeNiKiZ2r9RKxC57cymxlMIdiiTopBunGkBUkQAin3Vhgae+i1fyAm6ZRdjvUJsDUpAABjBf8Z7eO\/H6O7+L0xu3GDfP584Qp5fcl\/j0NLdxYBurM1b\/P8F9YH\/A0xk2wP\/TYGLl1pfnOcv3YPqGNMp3wgCdxT3HMu0H8qSM93hQEJbyqBYKspkDqVsbjSpKcy+rwpAAAcAQBABfl\/09pZH7EgoUSD\/8fAChtCo1Y1AAAAHAEAQAS7yrPlgGv7L1nnRIpTDubtvC1nmA==","packet_info":{"linktype":1},"tx_id":1,"alert":{"action":"allowed","gid":1,"signature_id":2224005,"rev":2,"signature":"SURICATA IKEv2 weak cryptographic parameters (Diffie-Hellman)","category":"Generic Protocol Command Decode","severity":3}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T448-0500","flow_id":1438754275321651,"in_iface":"re0","event_type":"ikev2","src_ip":"208.54.70.80","src_port":500,"dest_ip":"192.168.1.160","dest_port":59315,"proto":"UDP","ikev2":{"version_major":2,"version_minor":0,"exchange_type":34,"message_id":0,"init_spi":"b7ce3a1223a0edb8","resp_spi":"0140d9fa05660714","role":"responder","alg_enc":"ENCR_AES_CBC","alg_auth":"AUTH_HMAC_SHA1_96","alg_prf":"PRF_HMAC_SHA1","alg_dh":"1024-bit MODP Group","alg_esn":"NoESN","errors":0,"payload":["SecurityAssociation","KeyExchange","Nonce","Notify","Notify","NoNextPayload"],"notify":["NAT_DETECTION_DESTINATION_IP","NAT_DETECTION_SOURCE_IP"]}}
<13>Feb 26 10:36:32 pfSense suricata: {"timestamp":"2021-02-26T939-0500","flow_id":1438754275321651,"in_iface":"re0","event_type":"ikev2","src_ip":"192.168.1.160","src_port":59315,"dest_ip":"208.54.70.80","dest_port":500,"proto":"UDP","ikev2":{"version_major":2,"version_minor":0,"exchange_type":34,"message_id":0,"init_spi":"b7ce3a1223a0edb8","resp_spi":"0000000000000000","role":"initiator","errors":0,"payload":["SecurityAssociation","KeyExchange","Nonce","Notify","Notify","Notify","Notify","Notify","NoNextPayload"],"notify":["NAT_DETECTION_SOURCE_IP","NAT_DETECTION_DESTINATION_IP","IKEV2_FRAGMENTATION_SUPPORTED","SIGNATURE_HASH_ALGORITHMS","REDIRECT_SUPPORTED"]}}
<13>Feb 26 10:36:30 pfSense suricata: {"timestamp":"2021-02-26T420-0500","flow_id":2132741533272420,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":20180,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":86,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"detectportal.firefox.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"detectportal.firefox.com","rrtype":"CNAME","ttl":20,"rdata":"detectportal.prod.mozaws.net"},{"rrname":"detectportal.prod.mozaws.net","rrtype":"CNAME","ttl":259,"rdata":"prod.detectportal.prod.cloudops.mozgcp.net"},{"rrname":"prod.detectportal.prod.cloudops.mozgcp.net","rrtype":"A","ttl":808,"rdata":"34.107.221.82"}],"grouped":{"CNAME":["detectportal.prod.mozaws.net","prod.detectportal.prod.cloudops.mozgcp.net"],"A":["34.107.221.82"]}}}
<13>Feb 26 10:36:30 pfSense suricata: {"timestamp":"2021-02-26T439-0500","flow_id":774256262511060,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":22774,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":62989,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"detectportal.firefox.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"detectportal.firefox.com","rrtype":"CNAME","ttl":20,"rdata":"detectportal.prod.mozaws.net"},{"rrname":"detectportal.prod.mozaws.net","rrtype":"CNAME","ttl":259,"rdata":"prod.detectportal.prod.cloudops.mozgcp.net"},{"rrname":"prod.detectportal.prod.cloudops.mozgcp.net","rrtype":"A","ttl":808,"rdata":"34.107.221.82"}],"grouped":{"A":["34.107.221.82"],"CNAME":["detectportal.prod.mozaws.net","prod.detectportal.prod.cloudops.mozgcp.net"]}}}
<13>Feb 26 10:36:30 pfSense suricata: {"timestamp":"2021-02-26T596-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.160","src_port":57158,"dest_ip":"34.107.221.82","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US","cache_control":"no-cache","pragma":"no-cache","age":"58238","content_length":"8","content_type":"text\/plain","date":"Thu, 25 Feb 2021 23:25:51 GMT","server":"nginx","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8}}
<13>Feb 26 10:36:30 pfSense suricata: {"timestamp":"2021-02-26T596-0500","flow_id":493917304603576,"in_iface":"re0","event_type":"fileinfo","src_ip":"34.107.221.82","src_port":80,"dest_ip":"192.168.1.160","dest_port":57158,"proto":"TCP","http":{"hostname":"detectportal.firefox.com","url":"\/success.txt?ipv4","http_user_agent":"Mozilla\/5.0 (Android 11; Mobile; rv:86.0) Gecko\/86.0 Firefox\/86.0","http_content_type":"text\/plain","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":8},"app_proto":"http","fileinfo":{"filename":"\/success.txt","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":8,"tx_id":0}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T848-0500","flow_id":1180255225980192,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":6471,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":48232,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"example.org","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"example.org","rrtype":"A","ttl":14466,"rdata":"93.184.216.34"}],"grouped":{"A":["93.184.216.34"]}}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T862-0500","flow_id":886930434496950,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":60608,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":42446,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"example.org","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"example.org","rrtype":"A","ttl":14466,"rdata":"93.184.216.34"}],"grouped":{"A":["93.184.216.34"]}}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T492-0500","flow_id":774256262511060,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":22774,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":62989,"rrname":"detectportal.firefox.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T476-0500","flow_id":2132741533272420,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":20180,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":86,"rrname":"detectportal.firefox.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T696-0500","flow_id":646034308800721,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":30928,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":24193,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"ipv4only.arpa","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ipv4only.arpa","rrtype":"A","ttl":80325,"rdata":"192.0.0.171"},{"rrname":"ipv4only.arpa","rrtype":"A","ttl":80325,"rdata":"192.0.0.170"}],"grouped":{"A":["192.0.0.171","192.0.0.170"]}}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T118-0500","flow_id":886930434496950,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":60608,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":42446,"rrname":"example.org","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T937-0500","flow_id":646034308800721,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":30928,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":24193,"rrname":"ipv4only.arpa","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:29 pfSense suricata: {"timestamp":"2021-02-26T040-0500","flow_id":1180255225980192,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":6471,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":48232,"rrname":"example.org","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:24 pfSense suricata: {"timestamp":"2021-02-26T553-0500","flow_id":1819859607872078,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50232,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:24 pfSense suricata: {"timestamp":"2021-02-26T553-0500","flow_id":1819859607872078,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50232,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:23 pfSense suricata: {"timestamp":"2021-02-26T163-0500","flow_id":81890354007595,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58730,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":25671,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 10:36:23 pfSense suricata: {"timestamp":"2021-02-26T728-0500","flow_id":81890354007595,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58730,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":25671,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":469}]}}
<13>Feb 26 10:36:23 pfSense suricata: {"timestamp":"2021-02-26T779-0500","flow_id":81890354007595,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58730,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":2915,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":39,"rdata":"54.210.227.170"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":39,"rdata":"54.88.253.164"}],"grouped":{"A":["54.210.227.170","54.88.253.164"]}}}
<13>Feb 26 10:36:23 pfSense suricata: {"timestamp":"2021-02-26T762-0500","flow_id":1565389237940594,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":55006,"dest_ip":"54.210.227.170","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:23 pfSense suricata: {"timestamp":"2021-02-26T059-0500","flow_id":81890354007595,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58730,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":2915,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:22 pfSense suricata: {"timestamp":"2021-02-26T524-0500","flow_id":1359613059754056,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53714,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:22 pfSense suricata: {"timestamp":"2021-02-26T524-0500","flow_id":1359613059754056,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53714,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:22 pfSense suricata: {"timestamp":"2021-02-26T463-0500","flow_id":243572250346777,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.101","src_port":53713,"dest_ip":"140.82.113.25","dest_port":443,"proto":"TCP","tls":{"sni":"alive.github.com","version":"TLS 1.3","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:19 pfSense suricata: {"timestamp":"2021-02-26T283-0500","flow_id":1209508247519746,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":63120,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":60254,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"lamssettings-pa.googleapis.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"lamssettings-pa.googleapis.com","rrtype":"A","ttl":5,"rdata":"172.217.12.170"}],"grouped":{"A":["172.217.12.170"]}}}
<13>Feb 26 10:36:19 pfSense suricata: {"timestamp":"2021-02-26T578-0500","flow_id":1209508247519746,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":63120,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":60254,"rrname":"lamssettings-pa.googleapis.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:17 pfSense suricata: {"timestamp":"2021-02-26T850-0500","flow_id":30763055098674,"in_iface":"re0","event_type":"fileinfo","src_ip":"185.46.215.67","src_port":80,"dest_ip":"192.168.1.192","dest_port":64187,"proto":"TCP","http":{"hostname":"pac.zscloud.net","url":"\/TCLdDcs8QYCF\/zappinternal.pac","http_user_agent":"Mozilla\/5.0 ZTunnel\/1.0","xff":"192.168.1.192","http_content_type":"application\/x-ns-proxy-autoconfig","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":622},"app_proto":"http","fileinfo":{"filename":"\/TCLdDcs8QYCF\/zappinternal.pac","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":622,"tx_id":0}}
<13>Feb 26 10:36:16 pfSense suricata: {"timestamp":"2021-02-26T394-0500","flow_id":2033736085905936,"in_iface":"re0","event_type":"fileinfo","src_ip":"185.46.215.67","src_port":80,"dest_ip":"192.168.1.192","dest_port":64186,"proto":"TCP","http":{"hostname":"pac.zscloud.net","url":"\/WPMwvPCJ9m7d\/localproxyexternal.pac","http_user_agent":"Mozilla\/5.0 ZTunnel\/1.0","http_content_type":"application\/x-ns-proxy-autoconfig","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1928},"app_proto":"http","fileinfo":{"filename":"\/WPMwvPCJ9m7d\/localproxyexternal.pac","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1928,"tx_id":0}}
<13>Feb 26 10:36:15 pfSense suricata: {"timestamp":"2021-02-26T717-0500","flow_id":1804584556040357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.105","src_port":51387,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":59080,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"connectivitycheck.gstatic.com","rrtype":"AAAA","rcode":"NOERROR","answers":[{"rrname":"connectivitycheck.gstatic.com","rrtype":"AAAA","ttl":120,"rdata":"2607:f8b0:4006:0813:0000:0000:0000:2003"}],"grouped":{"AAAA":["2607:f8b0:4006:0813:0000:0000:0000:2003"]}}}
<13>Feb 26 10:36:15 pfSense suricata: {"timestamp":"2021-02-26T405-0500","flow_id":808023294374205,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.105","src_port":50198,"dest_ip":"142.250.64.67","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Mountain View, O=Google LLC, CN=*.gstatic.com","issuerdn":"C=US, O=Google Trust Services, CN=GTS CA 1O1","serial":"00:ED:61:42:0F:BA:F1:67:67:05:00:00:00:00:87:4A:5F","fingerprint":"c1:3c:db:68:25:d0:64:16:e1:33:83:74:f9:87:27:6b:df:04:27:da","sni":"connectivitycheck.gstatic.com","version":"TLS 1.2","notbefore":"2021-01-26T09:05:28","notafter":"2021-04-20T09:05:27","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:15 pfSense suricata: {"timestamp":"2021-02-26T788-0500","flow_id":1804584556040357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.105","src_port":51387,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":18021,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"connectivitycheck.gstatic.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"connectivitycheck.gstatic.com","rrtype":"A","ttl":93,"rdata":"142.250.64.67"}],"grouped":{"A":["142.250.64.67"]}}}
<13>Feb 26 10:36:15 pfSense suricata: {"timestamp":"2021-02-26T578-0500","flow_id":1804584556040357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.105","src_port":51387,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":59080,"rrname":"connectivitycheck.gstatic.com","rrtype":"AAAA","tx_id":1}}
<13>Feb 26 10:36:15 pfSense suricata: {"timestamp":"2021-02-26T549-0500","flow_id":1804584556040357,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.105","src_port":51387,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":18021,"rrname":"connectivitycheck.gstatic.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T547-0500","flow_id":417932889618901,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50231,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T547-0500","flow_id":417932889618901,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50231,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T407-0500","flow_id":2242392047234464,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52616,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T765-0500","flow_id":1230085435485493,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":40886,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":41339,"flags":"8580","qr":true,"aa":true,"rd":true,"ra":true,"rrname":"api.segment.io","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.segment.io","rrtype":"A","ttl":60,"rdata":"10.10.10.1"}],"grouped":{"A":["10.10.10.1"]}}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T549-0500","flow_id":1230085435485493,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.163","src_port":40886,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":41339,"rrname":"api.segment.io","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T854-0500","flow_id":1273567684351968,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52617,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLSv1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:13 pfSense suricata: {"timestamp":"2021-02-26T892-0500","flow_id":1366669690406296,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52615,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:12 pfSense suricata: {"timestamp":"2021-02-26T524-0500","flow_id":568344791702133,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53707,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:12 pfSense suricata: {"timestamp":"2021-02-26T524-0500","flow_id":568344791702133,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53707,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:05 pfSense suricata: {"timestamp":"2021-02-26T911-0500","flow_id":871374061334543,"in_iface":"re0","event_type":"alert","src_ip":"192.168.1.192","src_port":64204,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013933,"rev":5,"signature":"ET POLICY HTTP traffic on port 443 (CONNECT)","category":"Potentially Bad Traffic","severity":2,"metadata":{"updated_at":["2020_06_02"],"created_at":["2011_11_17"]}},"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","http_method":"CONNECT","protocol":"HTTP\/1.1","length":0},"app_proto":"http","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":502,"bytes_toclient":361,"start":"2021-02-26T295-0500"},"payload":"Q09OTkVDVCB3d3cuenNjYWxlci5jb206ODAgSFRUUC8xLjENCkhvc3Q6IHd3dy56c2NhbGVyLmNvbTo4MA0KVXNlci1BZ2VudDogV2luZG93cyBNaWNyb3NvZnQgV2luZG93cyAxMCBFbnRlcnByaXNlIFpUdW5uZWwvMS4wDQpQcm94eS1Db25uZWN0aW9uOiBrZWVwLWFsaXZlDQpDb25uZWN0aW9uOiBrZWVwLWFsaXZlDQpYLVpBcHBJbmZvOiA4NzdhZjAwZTFlODRkYzE0OTE1M2UyNWVmMjE5OTczMTkxY2VjMTBlNjJmMmE2OGZjOTBlYmJhZWIyZjk1MmExDQoNCg==","payload_printable":"CONNECT www.zscaler.com:80 HTTP\/1.1\r\nHost: www.zscaler.com:80\r\nUser-Agent: Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nX-ZAppInfo: 877af00e1e84dc149153e25ef219973191cec10e62f2a68fc90ebbaeb2f952a1\r\n\r\n","stream":1,"packet":"NOiU3oIMmCmmghHNCABFAAAolS1AAIAG1j3AqAHApeEnG\/rMAbuP+3BQtdq0NlARAgK3hwAAAAAAAAAA","packet_info":{"linktype":1}}
<13>Feb 26 10:36:05 pfSense suricata: {"timestamp":"2021-02-26T319-0500","flow_id":871374061334543,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64204,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"http":{"hostname":"www.zscaler.com","http_port":80,"url":"www.zscaler.com:80","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","content_length":"0","proxy_authenticate":"Digest realm=\"zscloud.net\", qop=\"auth\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\"","server":"Zscaler proxy","http_method":"CONNECT","protocol":"HTTP\/1.1","status":407,"length":0}}
<13>Feb 26 10:36:04 pfSense suricata: {"timestamp":"2021-02-26T509-0500","flow_id":1774405967648712,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64203,"dest_ip":"205.185.216.10","dest_port":80,"proto":"TCP","tx_id":0,"metadata":{"flowbits":["ET.INFO.WindowsUpdate"]},"http":{"hostname":"ctldl.windowsupdate.com","url":"\/msdownload\/update\/v3\/static\/trustedr\/en\/authrootstl.cab?c44648b58dd94b33","http_user_agent":"Microsoft-CryptoAPI\/10.0","accept":"*\/*","date":"Fri, 26 Feb 2021 15:36:03 GMT","http_method":"GET","protocol":"HTTP\/1.1","status":304,"length":0}}
<13>Feb 26 10:36:04 pfSense suricata: {"timestamp":"2021-02-26T812-0500","flow_id":1774405967648712,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64203,"dest_ip":"205.185.216.10","dest_port":80,"proto":"TCP","tx_id":1,"metadata":{"flowbits":["ET.INFO.WindowsUpdate"]},"http":{"hostname":"ctldl.windowsupdate.com","url":"\/msdownload\/update\/v3\/static\/trustedr\/en\/disallowedcertstl.cab?b5eaf36bf49e5429","http_user_agent":"Microsoft-CryptoAPI\/10.0","accept":"*\/*","date":"Fri, 26 Feb 2021 15:36:03 GMT","http_method":"GET","protocol":"HTTP\/1.1","status":304,"length":0}}
<13>Feb 26 10:36:03 pfSense suricata: {"timestamp":"2021-02-26T358-0500","flow_id":931061221749729,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50230,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:36:03 pfSense suricata: {"timestamp":"2021-02-26T813-0500","flow_id":2164373965732278,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":63427,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":9014,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"ctldl.windowsupdate.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ctldl.windowsupdate.com","rrtype":"CNAME","ttl":2376,"rdata":"au-bg-shim.trafficmanager.net"},{"rrname":"au-bg-shim.trafficmanager.net","rrtype":"CNAME","ttl":2946,"rdata":"audownload.windowsupdate.nsatc.net"},{"rrname":"audownload.windowsupdate.nsatc.net","rrtype":"CNAME","ttl":263,"rdata":"au.download.windowsupdate.com.hwcdn.net"},{"rrname":"au.download.windowsupdate.com.hwcdn.net","rrtype":"CNAME","ttl":1035,"rdata":"cds.d2s7q6s2.hwcdn.net"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":269,"rdata":"205.185.216.10"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":269,"rdata":"205.185.216.42"}],"grouped":{"A":["205.185.216.10","205.185.216.42"],"CNAME":["au-bg-shim.trafficmanager.net","audownload.windowsupdate.nsatc.net","au.download.windowsupdate.com.hwcdn.net","cds.d2s7q6s2.hwcdn.net"]}}}
<13>Feb 26 10:36:03 pfSense suricata: {"timestamp":"2021-02-26T358-0500","flow_id":931061221749729,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50230,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:36:03 pfSense suricata: {"timestamp":"2021-02-26T694-0500","flow_id":2164373965732278,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":63427,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":9014,"rrname":"ctldl.windowsupdate.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T644-0500","flow_id":89919794043940,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58657,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":55440,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T740-0500","flow_id":89919794043940,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58657,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":55440,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":6,"rdata":"54.88.253.164"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":6,"rdata":"54.210.227.170"}],"grouped":{"A":["54.88.253.164","54.210.227.170"]}}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T113-0500","flow_id":1501606824711963,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":56472,"dest_ip":"54.88.253.164","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T050-0500","flow_id":857432597329218,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":15754,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":8354,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"clients4.google.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"clients4.google.com","rrtype":"CNAME","ttl":57,"rdata":"clients.l.google.com"},{"rrname":"clients.l.google.com","rrtype":"A","ttl":46,"rdata":"172.217.6.206"}],"grouped":{"CNAME":["clients.l.google.com"],"A":["172.217.6.206"]}}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T801-0500","flow_id":89919794043940,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58657,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":50046,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T930-0500","flow_id":857432597329218,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":15754,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":8354,"rrname":"clients4.google.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:36:02 pfSense suricata: {"timestamp":"2021-02-26T715-0500","flow_id":89919794043940,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":58657,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":50046,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":490}]}}
<13>Feb 26 10:36:00 pfSense suricata: {"timestamp":"2021-02-26T693-0500","flow_id":469811798727926,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":33952,"dest_ip":"157.185.163.121","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Campbell, O=CDNetworks Inc., CN=support100.cdnetworks.net","issuerdn":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","serial":"06:6F:72:DD:26:BF:18:56:95:5F:39:AB:1B:7E:D3:5E","fingerprint":"57:b3:2d:fb:e9:bf:08:08:cb:a4:4f:6f:1f:cd:ed:9c:fc:59:85:12","sni":"us-odc.samsungapps.com","version":"TLS 1.2","notbefore":"2021-02-05T00:00:00","notafter":"2022-03-01T23:59:59","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T822-0500","flow_id":1449047162260001,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53699,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/images\/dev-network-wired.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":4320},"app_proto":"http","fileinfo":{"filename":"\/images\/dev-network-wired.png","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T822-0500","flow_id":1449047162260001,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53699,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/images\/dev-network-wired.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","accept":"image\/webp,*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"4320","content_type":"image\/png","date":"Fri, 26 Feb 2021 15:35:57 GMT","last_modified":"Wed, 25 Mar 2020 01:18:39 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":4320}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T764-0500","flow_id":1996780046315844,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53685,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/home.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_type":"text\/html","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":23265}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T821-0500","flow_id":900682917773308,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53698,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/images\/dev-video-television-3.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":2269},"app_proto":"http","fileinfo":{"filename":"\/images\/dev-video-television-3.png","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":2269,"tx_id":0}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T811-0500","flow_id":1507808757320412,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53700,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/images\/dev-network-wireless.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":5694},"app_proto":"http","fileinfo":{"filename":"\/images\/dev-network-wireless.png","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T821-0500","flow_id":900682917773308,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53698,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/images\/dev-video-television-3.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","accept":"image\/webp,*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"2269","content_type":"image\/png","date":"Fri, 26 Feb 2021 15:35:57 GMT","last_modified":"Wed, 25 Mar 2020 01:18:37 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":2269}}
<13>Feb 26 10:35:59 pfSense suricata: {"timestamp":"2021-02-26T811-0500","flow_id":1507808757320412,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53700,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/images\/dev-network-wireless.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","accept":"image\/webp,*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"5694","content_type":"image\/png","date":"Fri, 26 Feb 2021 15:35:57 GMT","last_modified":"Wed, 25 Mar 2020 01:18:37 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":5694}}
<13>Feb 26 10:35:58 pfSense suricata: {"timestamp":"2021-02-26T196-0500","flow_id":1935009826815234,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.101","src_port":53696,"dest_ip":"52.179.219.14","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=WA, L=Redmond, O=Microsoft, OU=DSP, CN=*.prod.do.dsp.mp.microsoft.com","issuerdn":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft ECC Content Distribution Secure Server CA 2.1","serial":"33:00:00:00:2D:8C:E3:5F:A7:F9:BF:40:AA:00:00:00:00:00:2D","fingerprint":"08:57:b5:5a:d5:e1:14:79:48:9e:97:b0:fc:92:16:6a:40:32:93:8d","sni":"array503.prod.do.dsp.mp.microsoft.com","version":"TLS 1.2","notbefore":"2020-12-10T19:24:24","notafter":"2021-12-10T19:24:24","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:56 pfSense suricata: {"timestamp":"2021-02-26T405-0500","flow_id":1880206043907586,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53687,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/bootstrap.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","accept":"text\/css,*\/*;q=0.1","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"145888","content_type":"text\/css","date":"Fri, 26 Feb 2021 15:35:53 GMT","last_modified":"Wed, 25 Mar 2020 01:18:34 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":145888}}
<13>Feb 26 10:35:56 pfSense suricata: {"timestamp":"2021-02-26T828-0500","flow_id":1589492592543924,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53690,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/jquery.js","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/javascript","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"268039","content_type":"text\/javascript","date":"Fri, 26 Feb 2021 15:35:54 GMT","last_modified":"Wed, 25 Mar 2020 01:18:34 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":268039}}
<13>Feb 26 10:35:56 pfSense suricata: {"timestamp":"2021-02-26T286-0500","flow_id":204687762244540,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53694,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/images\/frontier_logo.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","accept":"image\/webp,*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"3364","content_type":"image\/png","date":"Fri, 26 Feb 2021 15:35:54 GMT","last_modified":"Wed, 25 Mar 2020 01:19:00 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":3364}}
<13>Feb 26 10:35:56 pfSense suricata: {"timestamp":"2021-02-26T286-0500","flow_id":204687762244540,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53694,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/images\/frontier_logo.png","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"image\/png","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":3364},"app_proto":"http","fileinfo":{"filename":"\/images\/frontier_logo.png","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":3364,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T838-0500","flow_id":1589492592543924,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53690,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/jquery.js","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/javascript","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":7300},"app_proto":"http","fileinfo":{"filename":"\/jquery.js","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T828-0500","flow_id":2217515595467089,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53691,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/bootstrap.js","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/javascript","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":7300},"app_proto":"http","fileinfo":{"filename":"\/bootstrap.js","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T839-0500","flow_id":1996780046315844,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53685,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/home.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":9454},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/home.ha","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T822-0500","flow_id":2217515595467089,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53691,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/bootstrap.js","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/javascript","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"69707","content_type":"text\/javascript","date":"Fri, 26 Feb 2021 15:35:54 GMT","last_modified":"Wed, 25 Mar 2020 01:18:34 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":69707}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T843-0500","flow_id":1880206043907586,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53687,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/bootstrap.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":7300},"app_proto":"http","fileinfo":{"filename":"\/bootstrap.css","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T775-0500","flow_id":1156963616032495,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53688,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/baseres.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":7300},"app_proto":"http","fileinfo":{"filename":"\/baseres.css","sid":[],"gaps":false,"state":"TRUNCATED","stored":false,"size":4096,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T840-0500","flow_id":402376516831179,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53689,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/customnew.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","accept":"text\/css,*\/*;q=0.1","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"3164","content_type":"text\/css","date":"Fri, 26 Feb 2021 15:35:53 GMT","last_modified":"Wed, 25 Mar 2020 01:19:00 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":3164}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T840-0500","flow_id":402376516831179,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53689,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/customnew.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":3164},"app_proto":"http","fileinfo":{"filename":"\/customnew.css","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":3164,"tx_id":0}}
<13>Feb 26 10:35:55 pfSense suricata: {"timestamp":"2021-02-26T844-0500","flow_id":1156963616032495,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53688,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/baseres.css","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/css","accept":"text\/css,*\/*;q=0.1","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","cache_control":"max-age=0","dnt":"1","connection":"close","content_length":"17705","content_type":"text\/css","date":"Fri, 26 Feb 2021 15:35:53 GMT","last_modified":"Wed, 25 Mar 2020 01:19:00 GMT","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":17705}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T873-0500","flow_id":1412887832180078,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.101","src_port":58648,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":7283,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"ctldl.windowsupdate.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ctldl.windowsupdate.com","rrtype":"CNAME","ttl":2387,"rdata":"au-bg-shim.trafficmanager.net"},{"rrname":"au-bg-shim.trafficmanager.net","rrtype":"CNAME","ttl":2957,"rdata":"audownload.windowsupdate.nsatc.net"},{"rrname":"audownload.windowsupdate.nsatc.net","rrtype":"CNAME","ttl":274,"rdata":"au.download.windowsupdate.com.hwcdn.net"},{"rrname":"au.download.windowsupdate.com.hwcdn.net","rrtype":"CNAME","ttl":1046,"rdata":"cds.d2s7q6s2.hwcdn.net"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":280,"rdata":"205.185.216.10"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":280,"rdata":"205.185.216.42"}],"grouped":{"CNAME":["au-bg-shim.trafficmanager.net","audownload.windowsupdate.nsatc.net","au.download.windowsupdate.com.hwcdn.net","cds.d2s7q6s2.hwcdn.net"],"A":["205.185.216.10","205.185.216.42"]}}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T914-0500","flow_id":1163711009542682,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.7","src_port":34646,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":17140,"rrname":"www.google.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T745-0500","flow_id":77060661314631,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.107","src_port":58832,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":43232,"rrname":"dl-debug.dropbox.com","rrtype":"A","tx_id":2}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T310-0500","flow_id":1059304649524063,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50229,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T455-0500","flow_id":77060661314631,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.107","src_port":58832,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":43232,"rrname":"dl-debug.dropbox.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T040-0500","flow_id":77060661314631,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.107","src_port":58832,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":43232,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"dl-debug.dropbox.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"dl-debug.dropbox.com","rrtype":"CNAME","ttl":53,"rdata":"edge-block-debug-env.dropbox-dns.com"},{"rrname":"edge-block-debug-env.dropbox-dns.com","rrtype":"A","ttl":24,"rdata":"162.125.6.17"}],"grouped":{"CNAME":["edge-block-debug-env.dropbox-dns.com"],"A":["162.125.6.17"]}}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T553-0500","flow_id":1844867052896344,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.107","src_port":50228,"dest_ip":"162.125.6.17","dest_port":443,"proto":"TCP","tls":{"session_resumed":true,"sni":"dl-debug.dropbox.com","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T548-0500","flow_id":93978537495017,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53681,"dest_ip":"205.185.216.42","dest_port":80,"proto":"TCP","tx_id":0,"metadata":{"flowbits":["ET.INFO.WindowsUpdate"]},"http":{"hostname":"ctldl.windowsupdate.com","url":"\/msdownload\/update\/v3\/static\/trustedr\/en\/disallowedcertstl.cab?1c0ae29597b4d8eb","http_user_agent":"Microsoft-CryptoAPI\/10.0","accept":"*\/*","date":"Fri, 26 Feb 2021 15:35:52 GMT","http_method":"GET","protocol":"HTTP\/1.1","status":304,"length":0}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T437-0500","flow_id":1163711009542682,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.7","src_port":34646,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":17140,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"www.google.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"www.google.com","rrtype":"A","ttl":144,"rdata":"172.217.10.36"}],"grouped":{"A":["172.217.10.36"]}}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T732-0500","flow_id":77060661314631,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.107","src_port":58832,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":43232,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"dl-debug.dropbox.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"dl-debug.dropbox.com","rrtype":"CNAME","ttl":53,"rdata":"edge-block-debug-env.dropbox-dns.com"},{"rrname":"edge-block-debug-env.dropbox-dns.com","rrtype":"A","ttl":24,"rdata":"162.125.6.17"}],"grouped":{"A":["162.125.6.17"],"CNAME":["edge-block-debug-env.dropbox-dns.com"]}}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T310-0500","flow_id":1059304649524063,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50229,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:35:53 pfSense suricata: {"timestamp":"2021-02-26T297-0500","flow_id":1412887832180078,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.101","src_port":58648,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":7283,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"ctldl.windowsupdate.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"ctldl.windowsupdate.com","rrtype":"CNAME","ttl":2387,"rdata":"au-bg-shim.trafficmanager.net"},{"rrname":"au-bg-shim.trafficmanager.net","rrtype":"CNAME","ttl":2957,"rdata":"audownload.windowsupdate.nsatc.net"},{"rrname":"audownload.windowsupdate.nsatc.net","rrtype":"CNAME","ttl":274,"rdata":"au.download.windowsupdate.com.hwcdn.net"},{"rrname":"au.download.windowsupdate.com.hwcdn.net","rrtype":"CNAME","ttl":1046,"rdata":"cds.d2s7q6s2.hwcdn.net"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":10,"rdata":"205.185.216.42"},{"rrname":"cds.d2s7q6s2.hwcdn.net","rrtype":"A","ttl":10,"rdata":"205.185.216.10"}],"grouped":{"CNAME":["au-bg-shim.trafficmanager.net","audownload.windowsupdate.nsatc.net","au.download.windowsupdate.com.hwcdn.net","cds.d2s7q6s2.hwcdn.net"],"A":["205.185.216.42","205.185.216.10"]}}}
<13>Feb 26 10:35:52 pfSense suricata: {"timestamp":"2021-02-26T590-0500","flow_id":1412887832180078,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.101","src_port":58648,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":7283,"rrname":"ctldl.windowsupdate.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:35:52 pfSense suricata: {"timestamp":"2021-02-26T678-0500","flow_id":1412887832180078,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.101","src_port":58648,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":7283,"rrname":"ctldl.windowsupdate.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:49 pfSense suricata: {"timestamp":"2021-02-26T372-0500","flow_id":1746924618391085,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53677,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:35:49 pfSense suricata: {"timestamp":"2021-02-26T372-0500","flow_id":1746924618391085,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.101","src_port":53677,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T411-0500","flow_id":1874865251335555,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":34477,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":2346,"rrname":"api.thingspeak.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T986-0500","flow_id":750120690686536,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.192","src_port":64200,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=outlook.com","issuerdn":"C=US, O=DigiCert Inc, CN=DigiCert Cloud Services CA-1","serial":"02:5D:E9:86:1C:F8:F1:D4:DE:46:E9:16:6E:1F:9D:2E","fingerprint":"13:02:ce:97:89:ee:f5:4f:f2:46:02:d5:2c:21:2d:ca:b1:86:a0:09","sni":"outlook.office365.com","version":"TLS 1.2","notbefore":"2020-06-21T00:00:00","notafter":"2022-06-21T12:00:00","ja3":{},"ja3s":{},"from_proto":"http"}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T772-0500","flow_id":1874865251335555,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":34477,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":2346,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"api.thingspeak.com","rrtype":"A","ttl":25,"rdata":"54.210.227.170"},{"rrname":"api.thingspeak.com","rrtype":"A","ttl":25,"rdata":"54.88.253.164"}],"grouped":{"A":["54.210.227.170","54.88.253.164"]}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T201-0500","flow_id":146463037201574,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.107","src_port":50227,"dest_ip":"192.168.254.254","dest_port":80,"proto":"TCP","tx_id":0,"http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","accept":"*\/*","accept_encoding":"gzip, deflate","accept_language":"en-US,en;q=0.5","x_requested_with":"XMLHttpRequest","dnt":"1","connection":"close","content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T069-0500","flow_id":750120690686536,"in_iface":"re0","event_type":"http","src_ip":"192.168.1.192","src_port":64200,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"http":{"hostname":"outlook.office365.com","http_port":443,"url":"outlook.office365.com:443","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","xff":"192.168.1.192","proxy_authorization":"Digest username=\"@3a24753fb4dd3dceccbf4a7714d53eec8477bb1f8309fe15d17b5e133bf805e4\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\", realm=\"zscloud.net\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", cnonce=\"b43ba013551e19d0d861f571b314a9ee\", qop=\"auth\", uri=\"outlook.office365.com:443\", nc=00000004, response=\"6eeaadea6c4eca90e4087ff36da985e3\"","http_method":"CONNECT","protocol":"HTTP\/1.1","status":200,"length":0}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T514-0500","flow_id":1874865251335555,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":34477,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":65442,"rrname":"api.thingspeak.com","rrtype":"AAAA","tx_id":2}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T201-0500","flow_id":146463037201574,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.107","dest_port":50227,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T181-0500","flow_id":1685324049576297,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52614,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLSv1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T720-0500","flow_id":1874865251335555,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.115","src_port":34477,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":65442,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"api.thingspeak.com","rrtype":"AAAA","rcode":"NOERROR","authorities":[{"rrname":"thingspeak.com","rrtype":"SOA","ttl":509}]}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T783-0500","flow_id":441056991512891,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":51394,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":44523,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"outlook.office365.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"outlook.office365.com","rrtype":"CNAME","ttl":294,"rdata":"outlook.ha.office365.com"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"40.97.188.242"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.111.98"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.32.2"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.9.2"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.183.34"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.88.34"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.111.114"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.15.178"}],"grouped":{"A":["40.97.188.242","52.96.111.98","52.96.32.2","52.96.9.2","52.96.183.34","52.96.88.34","52.96.111.114","52.96.15.178"],"CNAME":["outlook.ha.office365.com"]}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T182-0500","flow_id":1383561794878730,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.115","src_port":55002,"dest_ip":"54.210.227.170","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=Massachusetts, L=Natick, O=The Mathworks, Inc., OU=EPS DevOps, CN=*.thingspeak.com","issuerdn":"C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert SHA2 High Assurance Server CA","serial":"09:A7:F2:88:3C:D1:00:37:85:CC:54:84:92:3F:AF:F1","fingerprint":"27:18:92:dd:a4:26:c3:07:09:b9:7a:e6:c5:21:b9:5b:48:f7:16:e1","sni":"api.thingspeak.com","version":"TLS 1.2","notbefore":"2020-05-02T00:00:00","notafter":"2022-08-03T12:00:00","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T073-0500","flow_id":441056991512891,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":51394,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":44523,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"outlook.office365.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"outlook.office365.com","rrtype":"CNAME","ttl":294,"rdata":"outlook.ha.office365.com"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"40.97.188.242"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.111.98"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.32.2"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.9.2"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.183.34"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.88.34"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.111.114"},{"rrname":"outlook.ha.office365.com","rrtype":"A","ttl":13,"rdata":"52.96.15.178"}],"grouped":{"A":["40.97.188.242","52.96.111.98","52.96.32.2","52.96.9.2","52.96.183.34","52.96.88.34","52.96.111.114","52.96.15.178"],"CNAME":["outlook.ha.office365.com"]}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T069-0500","flow_id":750120690686536,"in_iface":"re0","event_type":"alert","src_ip":"192.168.1.192","src_port":64200,"dest_ip":"165.225.39.27","dest_port":443,"proto":"TCP","tx_id":0,"alert":{"action":"allowed","gid":1,"signature_id":2013933,"rev":5,"signature":"ET POLICY HTTP traffic on port 443 (CONNECT)","category":"Potentially Bad Traffic","severity":2,"metadata":{"updated_at":["2020_06_02"],"created_at":["2011_11_17"]}},"http":{"hostname":"outlook.office365.com","http_port":443,"url":"outlook.office365.com:443","http_user_agent":"Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0","xff":"192.168.1.192","http_method":"CONNECT","protocol":"HTTP\/1.1","status":200,"length":0},"app_proto":"http","flow":{"pkts_toserver":4,"pkts_toclient":2,"bytes_toserver":1314,"bytes_toclient":185,"start":"2021-02-26T784-0500"},"payload":"Q09OTkVDVCBvdXRsb29rLm9mZmljZTM2NS5jb206NDQzIEhUVFAvMS4xDQpIb3N0OiBvdXRsb29rLm9mZmljZTM2NS5jb206NDQzDQpVc2VyLUFnZW50OiBXaW5kb3dzIE1pY3Jvc29mdCBXaW5kb3dzIDEwIEVudGVycHJpc2UgWlR1bm5lbC8xLjANClByb3h5LUNvbm5lY3Rpb246IGtlZXAtYWxpdmUNCkNvbm5lY3Rpb246IGtlZXAtYWxpdmUNClgtRm9yd2FyZGVkLUZvcjogMTkyLjE2OC4xLjE5Mg0KUHJveHktQXV0aG9yaXphdGlvbjogRGlnZXN0IHVzZXJuYW1lPSJAM2EyNDc1M2ZiNGRkM2RjZWNjYmY0YTc3MTRkNTNlZWM4NDc3YmIxZjgzMDlmZTE1ZDE3YjVlMTMzYmY4MDVlNCIsIG5vbmNlPSJhOWQ2ZGU5OGI5NmY4OTg3OTMwNGZmMzlhNjcyN2ZkZCIsIHJlYWxtPSJ6c2Nsb3VkLm5ldCIsIG9wYXF1ZT0iMjgwMjM0OGNkMDMxZWEzOWZhZjcwZjcyZjBiNTliOTQiLCBjbm9uY2U9ImI0M2JhMDEzNTUxZTE5ZDBkODYxZjU3MWIzMTRhOWVlIiwgcW9wPSJhdXRoIiwgdXJpPSJvdXRsb29rLm9mZmljZTM2NS5jb206NDQzIiwgbmM9MDAwMDAwMDQsIHJlc3BvbnNlPSI2ZWVhYWRlYTZjNGVjYTkwZTQwODdmZjM2ZGE5ODVlMyINCg0K","payload_printable":"CONNECT outlook.office365.com:443 HTTP\/1.1\r\nHost: outlook.office365.com:443\r\nUser-Agent: Windows Microsoft Windows 10 Enterprise ZTunnel\/1.0\r\nProxy-Connection: keep-alive\r\nConnection: keep-alive\r\nX-Forwarded-For: 192.168.1.192\r\nProxy-Authorization: Digest username=\"@3a24753fb4dd3dceccbf4a7714d53eec8477bb1f8309fe15d17b5e133bf805e4\", nonce=\"a9d6de98b96f89879304ff39a6727fdd\", realm=\"zscloud.net\", opaque=\"2802348cd031ea39faf70f72f0b59b94\", cnonce=\"b43ba013551e19d0d861f571b314a9ee\", qop=\"auth\", uri=\"outlook.office365.com:443\", nc=00000004, response=\"6eeaadea6c4eca90e4087ff36da985e3\"\r\n\r\n","stream":1,"packet":"NOiU3oIMmCmmghHNCABFAAIUlR9AAIAG1F\/AqAHApeEnG\/rIAbs8guY4iK9aEFAYAgK1tQAAFgMDAecBAAHjAwNgORVODpnCRFIpuNwezju375xg6oYCtXiny90jBSjndSBSNgAALZbaduMgxk9p\/wdkw7CjW89eLCKKvKKRJ10z+gAmwCzAK8AwwC\/AJMAjwCjAJ8AKwAnAFMATAJ0AnAA9ADwANQAvAAoBAAF0AAAAGgAYAAAVb3V0bG9vay5vZmZpY2UzNjUuY29tAAUABQEAAAAAAAoACAAGAB0AFwAYAAsAAgEAAA0AFAASBAEFAQIBBAMFAwIDAgIGAQYDACMBBAAAAACe+J4VD2vwRr3cmHmemVNGoI1rsDX0jPWYh4xWPBXWqA1zxmOhhuI4XcqH\/hper6SqOm1lTkZDhjQrcolJ8WSwAEIvHpZnwMOJ2ZtoMa64mgTfDtRnR1uSBCRIFwQr22aAulaXc4Byk1cHGIz7ZCLvQsZdonsYElL83XvqngQg8Km80JHbGCcPEEA9IstAl22v8hU1DFBwg9cqv45yKoxWDtl6vq2sslXdm1GIKPeW\/kDOTMomSy27ubanERlgyA+oU6Zn73IY3XbrOumVpqo6mS1UqspyS0O+ZCPGv9Dm1r+Qylf7zpVW07MB5i34p2ovLm0VvSvrb2J\/CbTntkyzABAADgAMAmgyCGh0dHAvMS4xABcAAP8BAAEA","packet_info":{"linktype":1}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T185-0500","flow_id":1157255673023663,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":33422,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":43354,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"nwsalert2.onelouder.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"nwsalert2.onelouder.com","rrtype":"A","ttl":300,"rdata":"52.191.103.130"}],"grouped":{"A":["52.191.103.130"]}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T382-0500","flow_id":1777567062163821,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52612,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T210-0500","flow_id":928683956008970,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":35188,"dest_ip":"52.191.103.130","dest_port":443,"proto":"TCP","tls":{"sni":"nwsalert2.onelouder.com","version":"TLS 1.3","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T323-0500","flow_id":780816821925860,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.163","src_port":52613,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"api.segment.io","version":"TLS 1.1","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T497-0500","flow_id":441056991512891,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":51394,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":44523,"rrname":"outlook.office365.com","rrtype":"A","tx_id":1}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T463-0500","flow_id":1157255673023663,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":33422,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":43354,"rrname":"nwsalert2.onelouder.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:43 pfSense suricata: {"timestamp":"2021-02-26T507-0500","flow_id":441056991512891,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.192","src_port":51394,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":44523,"rrname":"outlook.office365.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T484-0500","flow_id":1457497509327139,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":40758,"dest_ip":"10.10.10.1","dest_port":443,"proto":"TCP","tls":{"sni":"apiv2.moengage.com","version":"TLS 1.2","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T370-0500","flow_id":1943964832574713,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":45397,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":20449,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"nwsalert1.onelouder.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"nwsalert1.onelouder.com","rrtype":"A","ttl":300,"rdata":"52.191.103.130"}],"grouped":{"A":["52.191.103.130"]}}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T171-0500","flow_id":1733386881063840,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":46770,"dest_ip":"34.198.14.203","dest_port":443,"proto":"TCP","tls":{"subject":"CN=*.onelouder.com","issuerdn":"C=US, O=Amazon, OU=Server CA 1B, CN=Amazon","serial":"0C:95:D4:ED:06:51:B4:B7:37:11:E8:73:6A:69:9E:E3","fingerprint":"2c:5b:1a:7e:fa:15:c2:62:4c:bd:4a:ac:90:1d:01:b5:01:b6:64:ce","sni":"1weather.onelouder.com","version":"TLS 1.2","notbefore":"2021-02-26T00:00:00","notafter":"2022-03-27T23:59:59","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T990-0500","flow_id":395884672978188,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":35186,"dest_ip":"52.191.103.130","dest_port":443,"proto":"TCP","tls":{"sni":"nwsalert1.onelouder.com","version":"TLS 1.3","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T135-0500","flow_id":1009667711766671,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":33361,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":14978,"rrname":"1weather.onelouder.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T945-0500","flow_id":1943964832574713,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":45397,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":20449,"rrname":"nwsalert1.onelouder.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:42 pfSense suricata: {"timestamp":"2021-02-26T114-0500","flow_id":1009667711766671,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":33361,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":14978,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"1weather.onelouder.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"1weather.onelouder.com","rrtype":"A","ttl":46,"rdata":"34.198.14.203"},{"rrname":"1weather.onelouder.com","rrtype":"A","ttl":46,"rdata":"34.236.82.115"}],"grouped":{"A":["34.198.14.203","34.236.82.115"]}}}
<13>Feb 26 10:35:40 pfSense suricata: {"timestamp":"2021-02-26T820-0500","flow_id":1537078958182687,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":41928,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"version":2,"type":"answer","id":31202,"flags":"8180","qr":true,"rd":true,"ra":true,"rrname":"us-odc.samsungapps.com","rrtype":"A","rcode":"NOERROR","answers":[{"rrname":"us-odc.samsungapps.com","rrtype":"CNAME","ttl":105,"rdata":"us-odc.gw.samsungapps.com"},{"rrname":"us-odc.gw.samsungapps.com","rrtype":"CNAME","ttl":226,"rdata":"us-odc.samsungapps.com.gslb.cdnetworks.net"},{"rrname":"us-odc.samsungapps.com.gslb.cdnetworks.net","rrtype":"CNAME","ttl":155,"rdata":"us-odc.samsungapps.com.cdngc.net"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":22,"rdata":"157.185.163.121"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":22,"rdata":"163.171.138.222"},{"rrname":"us-odc.samsungapps.com.cdngc.net","rrtype":"A","ttl":22,"rdata":"163.171.139.179"}],"grouped":{"CNAME":["us-odc.gw.samsungapps.com","us-odc.samsungapps.com.gslb.cdnetworks.net","us-odc.samsungapps.com.cdngc.net"],"A":["157.185.163.121","163.171.138.222","163.171.139.179"]}}}
<13>Feb 26 10:35:40 pfSense suricata: {"timestamp":"2021-02-26T519-0500","flow_id":1537078958182687,"in_iface":"re0","event_type":"dns","src_ip":"192.168.1.160","src_port":41928,"dest_ip":"192.168.1.1","dest_port":53,"proto":"UDP","dns":{"type":"query","id":31202,"rrname":"us-odc.samsungapps.com","rrtype":"A","tx_id":0}}
<13>Feb 26 10:35:40 pfSense suricata: {"timestamp":"2021-02-26T736-0500","flow_id":1974888597019167,"in_iface":"re0","event_type":"tls","src_ip":"192.168.1.160","src_port":33942,"dest_ip":"157.185.163.121","dest_port":443,"proto":"TCP","tls":{"subject":"C=US, ST=California, L=Campbell, O=CDNetworks Inc., CN=support100.cdnetworks.net","issuerdn":"C=US, O=DigiCert Inc, CN=DigiCert TLS RSA SHA256 2020 CA1","serial":"06:6F:72:DD:26:BF:18:56:95:5F:39:AB:1B:7E:D3:5E","fingerprint":"57:b3:2d:fb:e9:bf:08:08:cb:a4:4f:6f:1f:cd:ed:9c:fc:59:85:12","sni":"us-odc.samsungapps.com","version":"TLS 1.2","notbefore":"2021-02-05T00:00:00","notafter":"2022-03-01T23:59:59","ja3":{},"ja3s":{}}}
<13>Feb 26 10:35:39 pfSense suricata: {"timestamp":"2021-02-26T437-0500","flow_id":1992478635470412,"in_iface":"re0","event_type":"fileinfo","src_ip":"192.168.254.254","src_port":80,"dest_ip":"192.168.1.101","dest_port":53670,"proto":"TCP","http":{"hostname":"192.168.254.254","url":"\/cgi-bin\/bannerstate.ha","http_user_agent":"Mozilla\/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko\/20100101 Firefox\/85.0","http_content_type":"text\/html","http_refer":"http:\/\/192.168.254.254\/cgi-bin\/home.ha","http_method":"GET","protocol":"HTTP\/1.1","status":200,"length":1716},"app_proto":"http","fileinfo":{"filename":"\/cgi-bin\/bannerstate.ha","sid":[],"gaps":false,"state":"CLOSED","stored":false,"size":1716,"tx_id":0}}

[a3ilson]

Can you expand the event within discover and provide a screenshot?

Comparing your suricata logs, they look the same (format) as mine. I'm guessing there may be a hangup within the 05-apps.conf where the log is enriched.

[revere521]

I also deleted and recreated the index, just in case - but hasn't helped yet

here is the cap of the top result expanded

[a3ilson]

I found it... there is a space that precedes the filtered message.

Update the initial grok again to remove the space after the colon:

%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\s*?(\[)?%{POSINT:[process][pid]}(\]:)?\s*(\-\s*\-)?\s*%{GREEDYDATA:filter_message}|%{POSINT:[log][syslog][priority]}?(%{INT:[log][syslog][version]}\s*)?(%{SYSLOGTIMESTAMP:[event][created]}|%{TIMESTAMP_ISO8601:[event][created]})\s(%{SYSLOGHOST:[host][name]}\s+)?%{PROG:[process][name]}\:\s%{GREEDYDATA:filter_message}

[revere521]

bam working! nicely done

Here are my suricata settings (for what is available for the interface) if you want to see if there are differences from OPNsense/5.0

[a3ilson]

And to confirm all other logs are working (i.e. the revised GROK didn't break anything as a result)?

[revere521]

Yes sir, everything else appears to be fine

[a3ilson]

Thanks @revere521

The settings for syslog-ng are still good-to-go?

[revere521]

I have them still set exactly in the example/instructions - no changes

[a3ilson]

Thanks! I'll close this issue and update the wiki shortly.

Let me know what you think of Suricata vs Snort