The Suricata network security monitor converts network
traffic into a stream of metadata events and provides a rule matching engine to
generate alerts. Suricata emits events in the EVE JSON format. The
output is a single stream of events where the event_type field disambiguates
the event type.
Tenzir's JSON can handle EVE JSON correctly, but for the schema
names to match the value from the event_type field, you need to pass the
option selector=event_type:suricata. The suricata parser does this by
default.
Use only the raw types that are native to the parsed format. Fields that have a type
specified in the chosen schema will still be parsed according to the schema.
Since Suricata is JSON, this means that JSON numbers will be parsed as numbers,
but every JSON string remains a string, unless the field is in the schema.
When working with an existing schema, this option will ensure that the output
schema has only the fields from that schema. If the schema name is obtained via a selector
and it does not exist, this has no effect.
This option requires either schema or selector to be set.
Instead of writing to a file, Suricata can also log to a UNIX domain socket that
Tenzir can then read from. This saves a filesystem round-trip. This requires the
following settings in your suricata.yaml:
Suricata creates eve.sock upon startup. Thereafter, you can read from the
socket: