['flow', 'flow', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns', 'dns']
src_ip: 192.168.10.9, src_port: 62892, dest_ip: 192.168.10.3, dest_port: 53, event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 6, flow_pkts_toclient: 6, flow_bytes_toserver: 492, flow_bytes_toclient: 1004, flow_age: 288, flow_state: established, flow_reason: timeout ; event_type: flow, proto: UDP, app_proto: dns, flow_pkts_toserver: 2, flow_pkts_toclient: 2, flow_bytes_toserver: 156, flow_bytes_toclient: 498, flow_age: 0, flow_state: established, flow_reason: timeout ; pcap_cnt: 5343945, event_type: dns, proto: UDP, dns_type: query, dns_id: 15584, dns_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 5343946, event_type: dns, proto: UDP, dns_type: query, dns_id: 15584, dns_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 5343947, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15584, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 151.101.20.175, dns_grouped_A_0: 151.101.20.175 ; pcap_cnt: 5343948, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 15584, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: cdn-fastly.krxd.net.c.global-ssl.fastly.net, dns_answers_0_rrtype: A, dns_answers_0_ttl: 1, dns_answers_0_rdata: 151.101.20.175, dns_grouped_A_0: 151.101.20.175 ; pcap_cnt: 5426226, event_type: dns, proto: UDP, dns_type: query, dns_id: 24406, dns_rrname: www.sporx.com, dns_rrtype: A, dns_tx_id: 4 ; pcap_cnt: 5426227, event_type: dns, proto: UDP, dns_type: query, dns_id: 24406, dns_rrname: www.sporx.com, dns_rrtype: A, dns_tx_id: 5 ; pcap_cnt: 5426228, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24406, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.sporx.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.sporx.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 35964, dns_answers_0_rdata: sporx.com, dns_answers_1_rrname: sporx.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 83506, dns_answers_1_rdata: 195.142.107.70, dns_grouped_CNAME_0: sporx.com, dns_grouped_A_0: 195.142.107.70 ; pcap_cnt: 5426229, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 24406, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: www.sporx.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: www.sporx.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 35964, dns_answers_0_rdata: sporx.com, dns_answers_1_rrname: sporx.com, dns_answers_1_rrtype: A, dns_answers_1_ttl: 83506, dns_answers_1_rdata: 195.142.107.70, dns_grouped_CNAME_0: sporx.com, dns_grouped_A_0: 195.142.107.70 ; pcap_cnt: 5901893, event_type: dns, proto: UDP, dns_type: query, dns_id: 7566, dns_rrname: d.agkn.com, dns_rrtype: A, dns_tx_id: 8 ; pcap_cnt: 5901894, event_type: dns, proto: UDP, dns_type: query, dns_id: 7566, dns_rrname: d.agkn.com, dns_rrtype: A, dns_tx_id: 9 ; pcap_cnt: 5901923, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7566, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.agkn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 449, dns_answers_0_rdata: data.agkn.com, dns_answers_1_rrname: data.agkn.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 13, dns_answers_1_rdata: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_2_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7, dns_answers_2_rdata: 52.38.131.10, dns_answers_3_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 7, dns_answers_3_rdata: 54.69.176.113, dns_answers_4_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 7, dns_answers_4_rdata: 52.41.108.104, dns_answers_5_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 7, dns_answers_5_rdata: 52.35.54.251, dns_answers_6_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 7, dns_answers_6_rdata: 52.38.154.51, dns_answers_7_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 7, dns_answers_7_rdata: 54.68.36.249, dns_answers_8_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 7, dns_answers_8_rdata: 54.148.139.215, dns_answers_9_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 7, dns_answers_9_rdata: 54.69.173.138, dns_grouped_CNAME_0: data.agkn.com, dns_grouped_CNAME_1: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_grouped_A_0: 52.38.131.10, dns_grouped_A_1: 54.69.176.113, dns_grouped_A_2: 52.41.108.104, dns_grouped_A_3: 52.35.54.251, dns_grouped_A_4: 52.38.154.51, dns_grouped_A_5: 54.68.36.249, dns_grouped_A_6: 54.148.139.215, dns_grouped_A_7: 54.69.173.138 ; pcap_cnt: 5901924, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7566, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: d.agkn.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: d.agkn.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 449, dns_answers_0_rdata: data.agkn.com, dns_answers_1_rrname: data.agkn.com, dns_answers_1_rrtype: CNAME, dns_answers_1_ttl: 13, dns_answers_1_rdata: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_2_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_2_rrtype: A, dns_answers_2_ttl: 7, dns_answers_2_rdata: 52.38.131.10, dns_answers_3_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_3_rrtype: A, dns_answers_3_ttl: 7, dns_answers_3_rdata: 54.69.176.113, dns_answers_4_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_4_rrtype: A, dns_answers_4_ttl: 7, dns_answers_4_rdata: 52.41.108.104, dns_answers_5_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_5_rrtype: A, dns_answers_5_ttl: 7, dns_answers_5_rdata: 52.35.54.251, dns_answers_6_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_6_rrtype: A, dns_answers_6_ttl: 7, dns_answers_6_rdata: 52.38.154.51, dns_answers_7_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_7_rrtype: A, dns_answers_7_ttl: 7, dns_answers_7_rdata: 54.68.36.249, dns_answers_8_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_8_rrtype: A, dns_answers_8_ttl: 7, dns_answers_8_rdata: 54.148.139.215, dns_answers_9_rrname: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_answers_9_rrtype: A, dns_answers_9_ttl: 7, dns_answers_9_rdata: 54.69.173.138, dns_grouped_CNAME_0: data.agkn.com, dns_grouped_CNAME_1: data-agkn-com-1423026942.us-west-2.elb.amazonaws.com, dns_grouped_A_0: 52.38.131.10, dns_grouped_A_1: 54.69.176.113, dns_grouped_A_2: 52.41.108.104, dns_grouped_A_3: 52.35.54.251, dns_grouped_A_4: 52.38.154.51, dns_grouped_A_5: 54.68.36.249, dns_grouped_A_6: 54.148.139.215, dns_grouped_A_7: 54.69.173.138 ; pcap_cnt: 9332401, event_type: dns, proto: UDP, dns_type: query, dns_id: 7547, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_tx_id: 0 ; pcap_cnt: 9332402, event_type: dns, proto: UDP, dns_type: query, dns_id: 7547, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_tx_id: 1 ; pcap_cnt: 9332403, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7547, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sdk.streamrail.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 90, dns_answers_0_rdata: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 54.192.37.249, dns_answers_2_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 54.192.37.194, dns_answers_3_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 54.192.37.67, dns_answers_4_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 54.192.37.39, dns_answers_5_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 54.192.37.126, dns_answers_6_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 54.192.37.90, dns_answers_7_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 54.192.37.155, dns_answers_8_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 54.192.37.38, dns_grouped_CNAME_0: d3o49rridkfcxi.cloudfront.net, dns_grouped_A_0: 54.192.37.249, dns_grouped_A_1: 54.192.37.194, dns_grouped_A_2: 54.192.37.67, dns_grouped_A_3: 54.192.37.39, dns_grouped_A_4: 54.192.37.126, dns_grouped_A_5: 54.192.37.90, dns_grouped_A_6: 54.192.37.155, dns_grouped_A_7: 54.192.37.38 ; pcap_cnt: 9332404, event_type: dns, proto: UDP, dns_version: 2, dns_type: answer, dns_id: 7547, dns_flags: 8180, dns_qr: True, dns_rd: True, dns_ra: True, dns_rrname: sdk.streamrail.com, dns_rrtype: A, dns_rcode: NOERROR, dns_answers_0_rrname: sdk.streamrail.com, dns_answers_0_rrtype: CNAME, dns_answers_0_ttl: 90, dns_answers_0_rdata: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_1_rrtype: A, dns_answers_1_ttl: 0, dns_answers_1_rdata: 54.192.37.249, dns_answers_2_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_2_rrtype: A, dns_answers_2_ttl: 0, dns_answers_2_rdata: 54.192.37.194, dns_answers_3_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_3_rrtype: A, dns_answers_3_ttl: 0, dns_answers_3_rdata: 54.192.37.67, dns_answers_4_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_4_rrtype: A, dns_answers_4_ttl: 0, dns_answers_4_rdata: 54.192.37.39, dns_answers_5_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_5_rrtype: A, dns_answers_5_ttl: 0, dns_answers_5_rdata: 54.192.37.126, dns_answers_6_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_6_rrtype: A, dns_answers_6_ttl: 0, dns_answers_6_rdata: 54.192.37.90, dns_answers_7_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_7_rrtype: A, dns_answers_7_ttl: 0, dns_answers_7_rdata: 54.192.37.155, dns_answers_8_rrname: d3o49rridkfcxi.cloudfront.net, dns_answers_8_rrtype: A, dns_answers_8_ttl: 0, dns_answers_8_rdata: 54.192.37.38, dns_grouped_CNAME_0: d3o49rridkfcxi.cloudfront.net, dns_grouped_A_0: 54.192.37.249, dns_grouped_A_1: 54.192.37.194, dns_grouped_A_2: 54.192.37.67, dns_grouped_A_3: 54.192.37.39, dns_grouped_A_4: 54.192.37.126, dns_grouped_A_5: 54.192.37.90, dns_grouped_A_6: 54.192.37.155, dns_grouped_A_7: 54.192.37.38
The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.
classification: Normal
justification: The network event described in the Suricata logs indicates normal behavior. This classification implies that the observed network activity does not exhibit any characteristics associated with malicious intent or attack patterns. Typical signs of attacks, such as unusual traffic patterns, suspicious connection attempts, or abnormal data exchanges, are absent. The network interactions recorded in the logs conform to expected and legitimate usage patterns, suggesting routine and benign operations.