['flow', 'flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.15, src_port: 56776, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 252, flow_bytes_toclient: 416, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 164, flow_bytes_toclient: 286, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 4, flow_bytes_toserver: 324, flow_bytes_toclient: 884, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 250, flow_bytes_toclient: 506, flow_age: 0, flow_state: established, flow_reason: shutdown ; pcap_cnt: 3733971, event_type: dns, proto: UDP, dns_type: query, dns_id: 21422, dns_rrname: nv-p1-elb-district-wrlin-01-2006273565.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3733972, event_type: dns, proto: UDP, dns_type: query, dns_id: 21422, dns_rrname: nv-p1-elb-district-wrlin-01-2006273565.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_tx_id: 1 ; pcap_cnt: 3733991, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21422, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nv-p1-elb-district-wrlin-01-2006273565.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 49, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3733992, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 21422, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: nv-p1-elb-district-wrlin-01-2006273565.us-east-1.elb.amazonaws.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: us-east-1.elb.amazonaws.com, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 49, dns_authorities_0_soa_mname: ns-1119.awsdns-11.org, dns_authorities_0_soa_rname: awsdns-hostmaster.amazon.com, dns_authorities_0_soa_serial: 1, dns_authorities_0_soa_refresh: 7200, dns_authorities_0_soa_retry: 900, dns_authorities_0_soa_expire: 1209600, dns_authorities_0_soa_minimum: 60 ; pcap_cnt: 3975038, event_type: dns, proto: UDP, dns_type: query, dns_id: 9720, dns_rrname: e5842.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 3975039, event_type: dns, proto: UDP, dns_type: query, dns_id: 9720, dns_rrname: e5842.g.akamaiedge.net, dns_rrtype: AAAA, dns_tx_id: 1 ; pcap_cnt: 3975040, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9720, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5842.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 883, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499432695, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 3975041, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 9720, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: e5842.g.akamaiedge.net, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_authorities_0_rrname: g.akamaiedge.net, dns_authorities_0_rrtype: SOA, dns_authorities_0_ttl: 883, dns_authorities_0_soa_mname: n0g.akamaiedge.net, dns_authorities_0_soa_rname: hostmaster.akamai.com, dns_authorities_0_soa_serial: 1499432695, dns_authorities_0_soa_refresh: 1000, dns_authorities_0_soa_retry: 1000, dns_authorities_0_soa_expire: 1000, dns_authorities_0_soa_minimum: 1800 ; pcap_cnt: 9841769, event_type: dns, proto: UDP, dns_type: query, dns_id: 31759, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_tx_id: 0 ; pcap_cnt: 9841770, event_type: dns, proto: UDP, dns_type: query, dns_id: 31759, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_tx_id: 1 ; pcap_cnt: 9841805, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.globalsigncdn.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 263, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 263, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 263, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 263, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 263, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:1cd8 ; pcap_cnt: 9841806, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.globalsigncdn.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 263, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 263, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 263, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 263, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 263, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:1cd8 ; pcap_cnt: 9841820, event_type: dns, proto: UDP, dns_type: query, dns_id: 31759, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_tx_id: 4 ; pcap_cnt: 9841821, event_type: dns, proto: UDP, dns_type: query, dns_id: 31759, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_tx_id: 5 ; pcap_cnt: 9841824, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.globalsigncdn.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 263, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 263, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 263, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 263, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 263, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:18d8 ; pcap_cnt: 9841825, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31759, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn.globalsigncdn.com, dns_rrtype: AAAA, dns_rcode: NOERROR, dns_answers_0_rrname: cdn.globalsigncdn.com, dns_answers_0_rrtype: AAAA, dns_answers_0_ttl: 263, dns_answers_0_rdata: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_answers_1_rrname: cdn.globalsigncdn.com, dns_answers_1_rrtype: AAAA, dns_answers_1_ttl: 263, dns_answers_1_rdata: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_answers_2_rrname: cdn.globalsigncdn.com, dns_answers_2_rrtype: AAAA, dns_answers_2_ttl: 263, dns_answers_2_rdata: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_answers_3_rrname: cdn.globalsigncdn.com, dns_answers_3_rrtype: AAAA, dns_answers_3_ttl: 263, dns_answers_3_rdata: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_answers_4_rrname: cdn.globalsigncdn.com, dns_answers_4_rrtype: AAAA, dns_answers_4_ttl: 263, dns_answers_4_rdata: 2400:cb00:2048:0001:0000:0000:6810:18d8, dns_grouped_AAAA_0: 2400:cb00:2048:0001:0000:0000:6810:1bd8, dns_grouped_AAAA_1: 2400:cb00:2048:0001:0000:0000:6810:19d8, dns_grouped_AAAA_2: 2400:cb00:2048:0001:0000:0000:6810:1ad8, dns_grouped_AAAA_3: 2400:cb00:2048:0001:0000:0000:6810:1cd8, dns_grouped_AAAA_4: 2400:cb00:2048:0001:0000:0000:6810:18d8 ; pcap_cnt: 9986393, event_type: dns, proto: UDP, dns_type: query, dns_id: 31174, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9986394, event_type: dns, proto: UDP, dns_type: query, dns_id: 31174, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 9986395, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31174, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 43, dns_answers_0_rdata: 50.18.172.166, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 43, dns_answers_1_rdata: 204.236.135.247, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 43, dns_answers_2_rdata: 50.18.253.140, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 43, dns_answers_3_rdata: 50.18.189.103, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 43, dns_answers_4_rdata: 50.18.251.157, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 43, dns_answers_5_rdata: 50.18.187.184, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 43, dns_answers_6_rdata: 50.18.253.40, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 43, dns_answers_7_rdata: 184.169.134.250, dns_grouped_A_0: 50.18.172.166, dns_grouped_A_1: 204.236.135.247, dns_grouped_A_2: 50.18.253.140, dns_grouped_A_3: 50.18.189.103, dns_grouped_A_4: 50.18.251.157, dns_grouped_A_5: 50.18.187.184, dns_grouped_A_6: 50.18.253.40, dns_grouped_A_7: 184.169.134.250 ; pcap_cnt: 9986396, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 31174, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 43, dns_answers_0_rdata: 50.18.172.166, dns_answers_1_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 43, dns_answers_1_rdata: 204.236.135.247, dns_answers_2_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 43, dns_answers_2_rdata: 50.18.253.140, dns_answers_3_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 43, dns_answers_3_rdata: 50.18.189.103, dns_answers_4_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 43, dns_answers_4_rdata: 50.18.251.157, dns_answers_5_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 43, dns_answers_5_rdata: 50.18.187.184, dns_answers_6_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 43, dns_answers_6_rdata: 50.18.253.40, dns_answers_7_rrname: ttd-uswest-match-adsrvr-org-454816348.us-west-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 43, dns_answers_7_rdata: 184.169.134.250, dns_grouped_A_0: 50.18.172.166, dns_grouped_A_1: 204.236.135.247, dns_grouped_A_2: 50.18.253.140, dns_grouped_A_3: 50.18.189.103, dns_grouped_A_4: 50.18.251.157, dns_grouped_A_5: 50.18.187.184, dns_grouped_A_6: 50.18.253.40, dns_grouped_A_7: 184.169.134.250
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.