['flow', 'flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.14, src_port: 50919, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 4, flow_pkts_toclient: 2, flow_bytes_toserver: 320, flow_bytes_toclient: 580, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 156, flow_bytes_toclient: 220, flow_age: 0, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 164, flow_bytes_toclient: 356, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 6053495, event_type: dns, proto: UDP, dns_type: query, dns_id: 47362, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6053496, event_type: dns, proto: UDP, dns_type: query, dns_id: 47362, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6053715, event_type: dns, proto: UDP, dns_type: query, dns_id: 47362, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_tx_id: 2 ; pcap_cnt: 6053716, event_type: dns, proto: UDP, dns_type: query, dns_id: 47362, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_tx_id: 3 ; pcap_cnt: 6054359, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47362, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rt.legolas-media.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 106, dns_answers_0_rdata: vir.legolas-media.com, dns_answers_1_rrname: vir.legolas-media.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 3500, dns_answers_1_rdata: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_2_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 51, dns_answers_2_rdata: 54.210.2.95, dns_answers_3_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 51, dns_answers_3_rdata: 52.1.46.247, dns_answers_4_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 51, dns_answers_4_rdata: 54.174.112.46, dns_answers_5_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 51, dns_answers_5_rdata: 34.194.13.14, dns_answers_6_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 51, dns_answers_6_rdata: 52.205.129.33, dns_answers_7_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 51, dns_answers_7_rdata: 54.174.68.157, dns_answers_8_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 51, dns_answers_8_rdata: 52.204.182.252, dns_answers_9_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 51, dns_answers_9_rdata: 54.82.238.28, dns_grouped_CNAME_0: vir.legolas-media.com, dns_grouped_CNAME_1: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_grouped_A_0: 54.210.2.95, dns_grouped_A_1: 52.1.46.247, dns_grouped_A_2: 54.174.112.46, dns_grouped_A_3: 34.194.13.14, dns_grouped_A_4: 52.205.129.33, dns_grouped_A_5: 54.174.68.157, dns_grouped_A_6: 52.204.182.252, dns_grouped_A_7: 54.82.238.28 ; pcap_cnt: 6054360, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 47362, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: rt.legolas-media.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: rt.legolas-media.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 106, dns_answers_0_rdata: vir.legolas-media.com, dns_answers_1_rrname: vir.legolas-media.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 3500, dns_answers_1_rdata: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_2_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 51, dns_answers_2_rdata: 54.210.2.95, dns_answers_3_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 51, dns_answers_3_rdata: 52.1.46.247, dns_answers_4_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 51, dns_answers_4_rdata: 54.174.112.46, dns_answers_5_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 51, dns_answers_5_rdata: 34.194.13.14, dns_answers_6_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 51, dns_answers_6_rdata: 52.205.129.33, dns_answers_7_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 51, dns_answers_7_rdata: 54.174.68.157, dns_answers_8_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 51, dns_answers_8_rdata: 52.204.182.252, dns_answers_9_rrname: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 51, dns_answers_9_rdata: 54.82.238.28, dns_grouped_A_0: 54.210.2.95, dns_grouped_A_1: 52.1.46.247, dns_grouped_A_2: 54.174.112.46, dns_grouped_A_3: 34.194.13.14, dns_grouped_A_4: 52.205.129.33, dns_grouped_A_5: 54.174.68.157, dns_grouped_A_6: 52.204.182.252, dns_grouped_A_7: 54.82.238.28, dns_grouped_CNAME_0: vir.legolas-media.com, dns_grouped_CNAME_1: VIRRT-ELB-PROD-1121794661.us-east-1.elb.amazonaws.com ; pcap_cnt: 6191603, event_type: dns, proto: UDP, dns_type: query, dns_id: 6603, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6191604, event_type: dns, proto: UDP, dns_type: query, dns_id: 6603, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6191605, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6603, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vcore.connatix.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 50, dns_answers_0_rdata: 54.172.218.83, dns_answers_1_rrname: vcore.connatix.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 50, dns_answers_1_rdata: 52.203.225.47, dns_grouped_A_0: 54.172.218.83, dns_grouped_A_1: 52.203.225.47 ; pcap_cnt: 6191606, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 6603, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: vcore.connatix.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: vcore.connatix.com, dns_answers_0_rrtype: A, dns_answers_0_ttl: 50, dns_answers_0_rdata: 54.172.218.83, dns_answers_1_rrname: vcore.connatix.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 50, dns_answers_1_rdata: 52.203.225.47, dns_grouped_A_0: 54.172.218.83, dns_grouped_A_1: 52.203.225.47 ; pcap_cnt: 6784422, event_type: dns, proto: UDP, dns_type: query, dns_id: 10124, dns_rrname: shavar.prod.mozaws.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 6784423, event_type: dns, proto: UDP, dns_type: query, dns_id: 10124, dns_rrname: shavar.prod.mozaws.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 6784424, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10124, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: shavar.prod.mozaws.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: shavar.prod.mozaws.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 42, dns_answers_0_rdata: 35.165.158.113, dns_answers_1_rrname: shavar.prod.mozaws.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 42, dns_answers_1_rdata: 54.200.60.113, dns_answers_2_rrname: shavar.prod.mozaws.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 42, dns_answers_2_rdata: 52.39.210.199, dns_answers_3_rrname: shavar.prod.mozaws.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 42, dns_answers_3_rdata: 35.160.9.151, dns_answers_4_rrname: shavar.prod.mozaws.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 42, dns_answers_4_rdata: 52.35.5.132, dns_answers_5_rrname: shavar.prod.mozaws.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 42, dns_answers_5_rdata: 52.37.48.84, dns_grouped_A_0: 35.165.158.113, dns_grouped_A_1: 54.200.60.113, dns_grouped_A_2: 52.39.210.199, dns_grouped_A_3: 35.160.9.151, dns_grouped_A_4: 52.35.5.132, dns_grouped_A_5: 52.37.48.84 ; pcap_cnt: 6784425, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 10124, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: shavar.prod.mozaws.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: shavar.prod.mozaws.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 42, dns_answers_0_rdata: 35.165.158.113, dns_answers_1_rrname: shavar.prod.mozaws.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 42, dns_answers_1_rdata: 54.200.60.113, dns_answers_2_rrname: shavar.prod.mozaws.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 42, dns_answers_2_rdata: 52.39.210.199, dns_answers_3_rrname: shavar.prod.mozaws.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 42, dns_answers_3_rdata: 35.160.9.151, dns_answers_4_rrname: shavar.prod.mozaws.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 42, dns_answers_4_rdata: 52.35.5.132, dns_answers_5_rrname: shavar.prod.mozaws.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 42, dns_answers_5_rdata: 52.37.48.84, dns_grouped_A_0: 35.165.158.113, dns_grouped_A_1: 54.200.60.113, dns_grouped_A_2: 52.39.210.199, dns_grouped_A_3: 35.160.9.151, dns_grouped_A_4: 52.35.5.132, dns_grouped_A_5: 52.37.48.84
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.