['flow', 'tls']
src_ip: 192.168.10.8, src_port: 56638, dest_ip: 184.73.221.50, dest_port: 443, event_type: flow, proto: TCP, app_proto: tls, flow_pkts_toserver: 18, flow_pkts_toclient: 17, flow_bytes_toserver: 1770, flow_bytes_toclient: 4472, flow_age: 61, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 11896079, event_type: tls, proto: TCP, tls_session_resumed: True, tls_sni: vidazoo-ip-detect.herokuapp.com, tls_version: TLS 1.2
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.