Vendors / Open Information Security Foundation / Suricata / Suricata suspicious HTTP POST

Event type

Suricata suspicious HTTP POST

Pinned suspicious HTTP POST alert with registry client/destination pairs, fresh timestamps and synthetic flow IDs/source ports.

JSON 22 fields Generator

suricata eve alert http

Preview Sample View Schema

CLI Install

meltr templates install oisf

Overview

What this event covers

Compact PCAP-oriented documentation example; signature 2018358 revision 10. Requires source-specific entities: entities/oisf/suricata/eve-alert.yaml; example configuration: configs/oisf/suricata/eve-alert.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›The pinned suspicious HTTP POST signature alerts.

Security relevance

Informational

Frequency notes

One event/second local test rate; five-event burst. Independent PCAP/flow snapshots, not a continuous packet counter.

Resources

Docs and tools

Suricata 8.0.6 EVE introductory example official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

timestamp

String Optional

One `now()` value through MELTr `iso8601_utc`; UTC Z with microseconds. Original whole-second Z samples remain valid.

Source: One `now()` value through MELTr `iso8601_utc`; UTC Z with microseconds. Original whole-second Z samples remain valid.

Example 2026-10-01T22:48:14.717331Z

flow_id

Integer Optional

Faker `fake.pyint(min_value=100000000000000, max_value=999999999999999)` once per event. Local 15-digit synthetic range, not Suricata's ID algorithm.

Source: Faker `fake.pyint(min_value=100000000000000, max_value=999999999999999)` once per event. Local 15-digit synthetic range, not Suricata's ID algorithm.

Example 523833780591779

pcap_cnt

Integer Optional

Fixed `53381`, the independent example's packet position.

Source: Fixed `53381`, the independent example's packet position.

Example 53381

event_type

String Optional

Fixed `alert`.

Source: Fixed `alert`.

Example alert

src_ip

String Optional

Selected registry client device's `ip_address`.

Source: Selected registry client device's `ip_address`.

Example 10.20.0.11

src_port

Integer Optional

Faker `fake.pyint(min_value=49152, max_value=65535)`; local ephemeral-port test range, not a universal client-port restriction.

Source: Faker `fake.pyint(min_value=49152, max_value=65535)`; local ephemeral-port test range, not a universal client-port restriction.

Example 64405

dest_ip

String Optional

Mapped HTTP service's `suricata_dest_ip`.

Source: Mapped HTTP service's `suricata_dest_ip`.

Example 198.51.100.21

dest_port

Integer Optional

Same service's `port`, required to be 80 in this scenario.

Source: Same service's `port`, required to be 80 in this scenario.

Example 80

proto

String Optional

Fixed `TCP`.

Source: Fixed `TCP`.

Example TCP

metadata

Object Optional

Contains only `flowbits`.

Source: Contains only `flowbits`.

Example {"flowbits":["http.dottedquadhost"]}

metadata.flowbits

Array Optional

Fixed single value `http.dottedquadhost`.

Source: Fixed single value `http.dottedquadhost`.

Example ["http.dottedquadhost"]

tx_id

Integer Optional

Fixed `4`, the independent flow example's transaction position.

Source: Fixed `4`, the independent flow example's transaction position.

Example 4

alert

Object Optional

Contains exactly the signature fields below.

Source: Contains exactly the signature fields below.

Example

{"action":"allowed","category":"Potentially Bad Traffic","gid":1,"rev":10,"severity":2,"signature":"ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1","signature_id":2018358}

alert.action

String Optional

Fixed `allowed`.

Source: Fixed `allowed`.

Example allowed

alert.gid

Integer Optional

Fixed `1`.

Source: Fixed `1`.

Example 1

alert.signature_id

Integer Optional

Fixed `2018358`.

Source: Fixed `2018358`.

Example 2018358

alert.rev

Integer Optional

Fixed `10`.

Source: Fixed `10`.

Example 10

alert.signature

String Optional

Fixed `ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1`.

Source: Fixed `ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1`.

Example ET HUNTING GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1

alert.category

String Optional

Fixed `Potentially Bad Traffic`.

Source: Fixed `Potentially Bad Traffic`.

Example Potentially Bad Traffic

alert.severity

Integer Optional

Fixed `2`.

Source: Fixed `2`.

Example 2

app_proto

String Optional

Fixed `http`.

Source: Fixed `http`.

Example http

metadata.flowbits[0]

String Optional

Fixed single value `http.dottedquadhost`. This field is the metadata.flowbits[0] member.

Source: Fixed single value `http.dottedquadhost`.

Example http.dottedquadhost