ids.bricata.alerts.all

Introduction

This table collects a variety of alert logs analyzed by Bricata IDS.

Source tables

The information displayed is extracted from the following tables:

ids.bricata.brocata
ids.bricata.burocata

Table structure

This is the set of columns displayed by this union table, which is the result of the collection of columns present in all source tables:

Extra fields

Fields marked as Extra in the table below are not shown by default in data tables and need to be explicitly requested in the query. You can find them marked as Extra when you perform a query so they can be easily identified. Learn more about this in Selecting unrevealed columns.

Field	Type	Extra fields
eventdate	`timestamp`
orig	`str`
host	`str`
dest_ip	`ip4`
dest_port	`str`
event_type	`str`
proto	`str`
src_ip	`ip4`
src_port	`str`
timestamp	`str`
alert_category	`str`
alert_rev	`int8`
alert_severity	`int8`
alert_signature	`str`
alert_signature_id	`int8`
event_format	`str`
event_source	`str`
event_uuid	`str`
sensor_ipv4	`ip4`
sensor_uuid	`str`
src_city_name	`str`
src_country	`str`
src_lat	`float8`
src_lon	`float8`
dst_city_name	`str`
dst_country	`str`
dst_lat	`float8`
dst_lon	`float8`
bytes_analyzed	`str`
conn_uids	`str`
download	`bool`
fid	`str`
file_description	`str`
filename	`str`
md5	`str`
mime_type	`str`
bro_proto	`str`
rx_host	`ip4`
rx_port	`str`
sha1	`str`
stored_as	`str`
transfer_proto	`str`
tx_host	`ip4`
tx_port	`str`
CauseMessage	`str`
Determinant	`str`
ParseStatus	`str`
SHA256	`str`
SampleFormat	`str`
SampleScoringActivityVersion	`int8`
SampleScoringVersion	`int8`
Score	`float8`
StatusCause	`str`
RaiseExceptionImports	`bool`
OSInfoImports	`bool`
DebugCheckImports	`bool`
TerminateProcessImports	`bool`
CodepageLookupImports	`bool`
hostchain	`str`
url	`str`
http_content_type	`str`
http_method	`str`
http_user_agent	`str`
hostname	`str`
jsonEvent	`json`
tag	`str`	✓

Field transformations

Even though all source tables have several features in common, they have some particularities that make it necessary to undergo a set of transformations to harmonize them for the union table. The most common transformations comprise changes in the data type or the application of rules when several columns in the source table feed a single column in the union table. You can find below the detailed list of transformations in each source table.

ids.bricata.brocata
ids.bricata.burocata

ids.bricata.brocata

Field in union table	Field in source table	Field transformation	Type	Extra fields
eventdate	eventdate		`timestamp`
orig	-	"brocata"	`str`
host	host		`str`
dest_ip	dest_ip	ip4(dest_ip)	`ip4`
dest_port	dest_port	str(dest_port)	`str`
event_type	event_type		`str`
proto	proto		`str`
src_ip	src_ip	ip4(src_ip)	`ip4`
src_port	src_port	str(src_port)	`str`
timestamp	timestamp		`str`
alert_category	category		`str`
alert_rev	rev	int8(rev)	`int8`
alert_severity	severity	int8(severity)	`int8`
alert_signature	signature		`str`
alert_signature_id	signature_id	int8(signature_id)	`int8`
event_format	event_format		`str`
event_source	event_source		`str`
event_uuid	event_uuid		`str`
sensor_ipv4	sensor_ipv4	ip4(sensor_ipv4)	`ip4`
sensor_uuid	sensor_uuid		`str`
src_city_name	src_city_name		`str`
src_country	src_country		`str`
src_lat	src_lat		`float8`
src_lon	src_lon		`float8`
dst_city_name	dst_city_name		`str`
dst_country	dst_country		`str`
dst_lat	dst_lat		`float8`
dst_lon	dst_lon		`float8`
bytes_analyzed	-	null("")	`str`
conn_uids	-	null("")	`str`
download	false	null(false)	`bool`
fid	-	null("")	`str`
file_description	-	null("")	`str`
filename	-	null("")	`str`
md5	-	null("")	`str`
mime_type	-	null("")	`str`
bro_proto	-	null("")	`str`
rx_host	-	null(ip4("0.0.0.0"))	`ip4`
rx_port	-	null("")	`str`
sha1	-	null("")	`str`
stored_as	-	null("")	`str`
transfer_proto	-	null("")	`str`
tx_host	-	null(ip4("0.0.0.0"))	`ip4`
tx_port	-	null("")	`str`
CauseMessage	-	null("")	`str`
Determinant	-	null("")	`str`
ParseStatus	-	null("")	`str`
SHA256	-	null("")	`str`
SampleFormat	-	null("")	`str`
SampleScoringActivityVersion	-	null(int8(0))	`int8`
SampleScoringVersion	-	null(int8(0))	`int8`
Score	-	null(float8(0))	`float8`
StatusCause	-	null("")	`str`
RaiseExceptionImports	false	null(false)	`bool`
OSInfoImports	false	null(false)	`bool`
DebugCheckImports	false	null(false)	`bool`
TerminateProcessImports	false	null(false)	`bool`
CodepageLookupImports	false	null(false)	`bool`
hostchain	hostchain		`str`
url	url		`str`
http_content_type	http_content_type		`str`
http_method	http_method		`str`
http_user_agent	http_user_agent		`str`
hostname	hostname		`str`
jsonEvent	jsonEvent		`json`
tag	tag		`str`	✓

ids.bricata.burocata

Field in union table	Field in source table	Field transformation	Type	Extra fields
eventdate	eventdate		`timestamp`
orig	-	"burocata"	`str`
host	host		`str`
dest_ip	dest_ip		`ip4`
dest_port	dest_port		`str`
event_type	event_type		`str`
proto	proto		`str`
src_ip	src_ip		`ip4`
src_port	src_port		`str`
timestamp	timestamp		`str`
alert_category	alert_category		`str`
alert_rev	alert_rev	int8(alert_rev)	`int8`
alert_severity	alert_severity	int8(alert_severity)	`int8`
alert_signature	alert_signature		`str`
alert_signature_id	alert_signature_id	int8(alert_signature_id)	`int8`
event_format	event_format		`str`
event_source	event_source		`str`
event_uuid	event_uuid		`str`
sensor_ipv4	sensor_ipv4		`ip4`
sensor_uuid	sensor_uuid		`str`
src_city_name	city_name		`str`
src_country	country		`str`
src_lat	lat		`float8`
src_lon	lon		`float8`
dst_city_name	-	null("")	`str`
dst_country	-	null("")	`str`
dst_lat	-	null(float8(0))	`float8`
dst_lon	-	null(float8(0))	`float8`
bytes_analyzed	bytes_analyzed		`str`
conn_uids	conn_uids		`str`
download	download		`bool`
fid	fid		`str`
file_description	file_description		`str`
filename	filename		`str`
md5	md5		`str`
mime_type	mime_type		`str`
bro_proto	bro_proto		`str`
rx_host	rx_host		`ip4`
rx_port	rx_port		`str`
sha1	sha1		`str`
stored_as	stored_as		`str`
transfer_proto	transfer_proto		`str`
tx_host	tx_host		`ip4`
tx_port	tx_port		`str`
CauseMessage	CauseMessage		`str`
Determinant	Determinant		`str`
ParseStatus	ParseStatus		`str`
SHA256	SHA256		`str`
SampleFormat	SampleFormat		`str`
SampleScoringActivityVersion	SampleScoringActivityVersion	int8(SampleScoringActivityVersion)	`int8`
SampleScoringVersion	SampleScoringVersion	int8(SampleScoringVersion)	`int8`
Score	Score		`float8`
StatusCause	StatusCause		`str`
RaiseExceptionImports	RaiseExceptionImports		`bool`
OSInfoImports	OSInfoImports		`bool`
DebugCheckImports	DebugCheckImports		`bool`
TerminateProcessImports	TerminateProcessImports		`bool`
CodepageLookupImports	CodepageLookupImports		`bool`
hostchain	-	null("")	`str`
url	-	null("")	`str`
http_content_type	-	null("")	`str`
http_method	-	null("")	`str`
http_user_agent	-	null("")	`str`
hostname	-	null("")	`str`
jsonEvent	jsonEvent		`json`
tag	tag		`str`	✓