['flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.15, src_port: 51690, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 328, flow_bytes_toclient: 384, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 328, flow_bytes_toclient: 368, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 224, flow_bytes_toclient: 480, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 150, flow_bytes_toclient: 246, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 2870953, event_type: dns, proto: UDP, dns_type: query, dns_id: 19565, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2870954, event_type: dns, proto: UDP, dns_type: query, dns_id: 19565, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 2870992, event_type: dns, proto: UDP, dns_type: query, dns_id: 19565, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 2870993, event_type: dns, proto: UDP, dns_type: query, dns_id: 19565, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 2871049, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19565, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.atlantafalcons.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 191, dns_answers_0_rdata: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrname: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 19728, dns_answers_1_rdata: a979.g.akamai.net, dns_answers_2_rrname: a979.g.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 208.185.118.91, dns_answers_3_rrname: a979.g.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 208.185.118.99, dns_grouped_CNAME_0: www.atlantafalcons.com.edgesuite.net, dns_grouped_CNAME_1: a979.g.akamai.net, dns_grouped_A_0: 208.185.118.91, dns_grouped_A_1: 208.185.118.99 ; pcap_cnt: 2871050, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 19565, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.atlantafalcons.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.atlantafalcons.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 191, dns_answers_0_rdata: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrname: www.atlantafalcons.com.edgesuite.net, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 19728, dns_answers_1_rdata: a979.g.akamai.net, dns_answers_2_rrname: a979.g.akamai.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 1, dns_answers_2_rdata: 208.185.118.91, dns_answers_3_rrname: a979.g.akamai.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 1, dns_answers_3_rdata: 208.185.118.99, dns_grouped_CNAME_0: www.atlantafalcons.com.edgesuite.net, dns_grouped_CNAME_1: a979.g.akamai.net, dns_grouped_A_0: 208.185.118.91, dns_grouped_A_1: 208.185.118.99 ; pcap_cnt: 2909472, event_type: dns, proto: UDP, dns_type: query, dns_id: 32592, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2909473, event_type: dns, proto: UDP, dns_type: query, dns_id: 32592, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 2909491, event_type: dns, proto: UDP, dns_type: query, dns_id: 32592, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 2909492, event_type: dns, proto: UDP, dns_type: query, dns_id: 32592, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 2909540, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32592, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static-wildcat.nfl.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: http2.nfl.map.fastly.net, dns_answers_1_rrname: http2.nfl.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 151.101.1.63, dns_answers_2_rrname: http2.nfl.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 151.101.65.63, dns_answers_3_rrname: http2.nfl.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 151.101.129.63, dns_answers_4_rrname: http2.nfl.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 151.101.193.63, dns_grouped_CNAME_0: http2.nfl.map.fastly.net, dns_grouped_A_0: 151.101.1.63, dns_grouped_A_1: 151.101.65.63, dns_grouped_A_2: 151.101.129.63, dns_grouped_A_3: 151.101.193.63 ; pcap_cnt: 2909541, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 32592, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: static-wildcat.nfl.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: static-wildcat.nfl.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 21, dns_answers_0_rdata: http2.nfl.map.fastly.net, dns_answers_1_rrname: http2.nfl.map.fastly.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 29, dns_answers_1_rdata: 151.101.1.63, dns_answers_2_rrname: http2.nfl.map.fastly.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 29, dns_answers_2_rdata: 151.101.65.63, dns_answers_3_rrname: http2.nfl.map.fastly.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 29, dns_answers_3_rdata: 151.101.129.63, dns_answers_4_rrname: http2.nfl.map.fastly.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 29, dns_answers_4_rdata: 151.101.193.63, dns_grouped_A_0: 151.101.1.63, dns_grouped_A_1: 151.101.65.63, dns_grouped_A_2: 151.101.129.63, dns_grouped_A_3: 151.101.193.63, dns_grouped_CNAME_0: http2.nfl.map.fastly.net ; pcap_cnt: 2972142, event_type: dns, proto: UDP, dns_type: query, dns_id: 54269, dns_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 2972143, event_type: dns, proto: UDP, dns_type: query, dns_id: 54269, dns_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 2972146, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54269, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 16, dns_answers_0_rdata: 54.87.166.181, dns_answers_1_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 50.17.177.105, dns_answers_2_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 16, dns_answers_2_rdata: 34.225.147.89, dns_answers_3_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 16, dns_answers_3_rdata: 34.204.34.37, dns_answers_4_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 16, dns_answers_4_rdata: 52.0.93.246, dns_answers_5_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 16, dns_answers_5_rdata: 54.82.184.56, dns_answers_6_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 16, dns_answers_6_rdata: 34.204.254.35, dns_answers_7_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 16, dns_answers_7_rdata: 54.88.144.196, dns_grouped_A_0: 54.87.166.181, dns_grouped_A_1: 50.17.177.105, dns_grouped_A_2: 34.225.147.89, dns_grouped_A_3: 34.204.34.37, dns_grouped_A_4: 52.0.93.246, dns_grouped_A_5: 54.82.184.56, dns_grouped_A_6: 34.204.254.35, dns_grouped_A_7: 54.88.144.196 ; pcap_cnt: 2972147, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 54269, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 16, dns_answers_0_rdata: 54.87.166.181, dns_answers_1_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 16, dns_answers_1_rdata: 50.17.177.105, dns_answers_2_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 16, dns_answers_2_rdata: 34.225.147.89, dns_answers_3_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 16, dns_answers_3_rdata: 34.204.34.37, dns_answers_4_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 16, dns_answers_4_rdata: 52.0.93.246, dns_answers_5_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 16, dns_answers_5_rdata: 54.82.184.56, dns_answers_6_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 16, dns_answers_6_rdata: 34.204.254.35, dns_answers_7_rrname: data-agkn-com-1198526359.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 16, dns_answers_7_rdata: 54.88.144.196, dns_grouped_A_0: 54.87.166.181, dns_grouped_A_1: 50.17.177.105, dns_grouped_A_2: 34.225.147.89, dns_grouped_A_3: 34.204.34.37, dns_grouped_A_4: 52.0.93.246, dns_grouped_A_5: 54.82.184.56, dns_grouped_A_6: 34.204.254.35, dns_grouped_A_7: 54.88.144.196 ; pcap_cnt: 3061568, event_type: dns, proto: UDP, dns_type: query, dns_id: 7263, dns_rrname: tracking.prf.hn, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 3061569, event_type: dns, proto: UDP, dns_type: query, dns_id: 7263, dns_rrname: tracking.prf.hn, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 3061570, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7263, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tracking.prf.hn, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tracking.prf.hn, dns_answers_0_rrtype: A, dns_answers_0_ttl: 39, dns_answers_0_rdata: 5.150.170.5, dns_answers_1_rrname: tracking.prf.hn, dns_answers_1_rrtype: A, dns_answers_1_ttl: 39, dns_answers_1_rdata: 5.150.170.6, dns_answers_2_rrname: tracking.prf.hn, dns_answers_2_rrtype: A, dns_answers_2_ttl: 39, dns_answers_2_rdata: 5.150.170.4, dns_grouped_A_0: 5.150.170.5, dns_grouped_A_1: 5.150.170.6, dns_grouped_A_2: 5.150.170.4 ; pcap_cnt: 3061571, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7263, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: tracking.prf.hn, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: tracking.prf.hn, dns_answers_0_rrtype: A, dns_answers_0_ttl: 39, dns_answers_0_rdata: 5.150.170.5, dns_answers_1_rrname: tracking.prf.hn, dns_answers_1_rrtype: A, dns_answers_1_ttl: 39, dns_answers_1_rdata: 5.150.170.6, dns_answers_2_rrname: tracking.prf.hn, dns_answers_2_rrtype: A, dns_answers_2_ttl: 39, dns_answers_2_rdata: 5.150.170.4, dns_grouped_A_0: 5.150.170.5, dns_grouped_A_1: 5.150.170.6, dns_grouped_A_2: 5.150.170.4
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.