{"timestamp":"2020-03-04T19:18:35.196472+0000","rule":{"level":6,"description":"IDS event.","id":"20101","firedtimes":1,"mail":false,"groups":["ids"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.5603","full_log":"03/04/2020-19:18:35.196472  [**] [1:2221030:1] SURICATA HTTP METHOD terminated by non-compliant character [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 192.168.10.238:47564 -> 192.168.10.154:80","predecoder":{"timestamp":"03/04/2020-19:18:35.196472"},"decoder":{"parent":"snort","name":"snort"},"data":{"srcip":"192.168.10.238","dstip":"192.168.10.154:80","id":"1:2221030:1"},"location":"/var/log/forensic/suricata/fast.log"}
{"timestamp":"2020-03-04T19:18:34.343787+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":1,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.6012","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.343787+0000\",\"flow_id\":2066313044966357,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46938,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.ncf\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.343787+0000","flow_id":"2066313044966357.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46938","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.ncf","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.345338+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":2,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.7549","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.345338+0000\",\"flow_id\":1697602987508313,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46940,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.Htm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.345338+0000","flow_id":"1697602987508313.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46940","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.Htm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.347250+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":3,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.9086","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.347250+0000\",\"flow_id\":1217064866564597,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46942,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.csc\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.347250+0000","flow_id":"1217064866564597.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46942","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.csc","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.349169+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":4,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.10623","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.349169+0000\",\"flow_id\":883960087990575,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46944,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.el\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.349169+0000","flow_id":"883960087990575.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46944","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.el","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.351261+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":5,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.12157","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.351261+0000\",\"flow_id\":455618704595240,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46946,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.idc\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.351261+0000","flow_id":"455618704595240.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46946","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.idc","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.353104+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":6,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.13693","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.353104+0000\",\"flow_id\":1306962827043002,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46948,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.access\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.353104+0000","flow_id":"1306962827043002.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46948","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.access","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.355207+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":7,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.15237","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.355207+0000\",\"flow_id\":1369948522440834,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46950,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.jsp+\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.355207+0000","flow_id":"1369948522440834.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46950","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.jsp+","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.358195+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":8,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.16777","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.358195+0000\",\"flow_id\":583080449044546,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46952,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.de\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.358195+0000","flow_id":"583080449044546.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46952","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.de","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.361389+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":9,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.18311","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.361389+0000\",\"flow_id\":570105352846820,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46954,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.en\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.361389+0000","flow_id":"570105352846820.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46954","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.en","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.365743+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":10,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.19845","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.365743+0000\",\"flow_id\":776469941489987,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46956,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.config\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.365743+0000","flow_id":"776469941489987.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46956","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.config","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.367902+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":11,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.21387","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.367902+0000\",\"flow_id\":829521377532493,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46958,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.et\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.367902+0000","flow_id":"829521377532493.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46958","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.et","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.370560+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":12,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.22921","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.370560+0000\",\"flow_id\":380826144121724,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46960,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cmd\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.370560+0000","flow_id":"380826144121724.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46960","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cmd","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.372779+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":13,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.24457","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.372779+0000\",\"flow_id\":319004384865496,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46962,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.x-shop\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.372779+0000","flow_id":"319004384865496.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46962","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.x-shop","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.375251+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":14,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.25999","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.375251+0000\",\"flow_id\":1.67220255094931e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46964,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.dbc\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.375251+0000","flow_id":"1672202550949310.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46964","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.dbc","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.377295+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":15,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.27541","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.377295+0000\",\"flow_id\":2.17615683359514e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46966,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.map\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.377295+0000","flow_id":"2176156833595140.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46966","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.map","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.379849+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":16,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.29083","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.379849+0000\",\"flow_id\":1414354189338696,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46968,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.Big5\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.379849+0000","flow_id":"1414354189338696.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46968","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.Big5","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.382662+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":17,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.30623","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.382662+0000\",\"flow_id\":268736087642508,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46970,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.10:100\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.382662+0000","flow_id":"268736087642508.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46970","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.10:100","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.385406+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":18,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.32165","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.385406+0000\",\"flow_id\":1931339402763667,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46972,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.nsf\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.385406+0000","flow_id":"1931339402763667.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46972","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.nsf","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.388338+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":19,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.33703","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.388338+0000\",\"flow_id\":2192726817433916,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46974,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.render_warning_screen\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.388338+0000","flow_id":"2192726817433916.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46974","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.render_warning_screen","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.390615+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":20,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.35277","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.390615+0000\",\"flow_id\":769894346584834,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46976,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.phtml\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.390615+0000","flow_id":"769894346584834.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46976","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.phtml","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.393834+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":21,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.36817","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.393834+0000\",\"flow_id\":1990996498513606,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46978,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.bin\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.393834+0000","flow_id":"1990996498513606.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46978","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.bin","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.396042+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":22,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.38355","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.396042+0000\",\"flow_id\":1431362259781643,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46980,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.dat\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.396042+0000","flow_id":"1431362259781643.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46980","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.dat","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.399022+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":23,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.39893","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.399022+0000\",\"flow_id\":2013892969108308,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46982,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.dbm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.399022+0000","flow_id":"2013892969108308.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46982","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.dbm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.401306+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":24,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.41431","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.401306+0000\",\"flow_id\":1806467523550245,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46984,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.html\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.401306+0000","flow_id":"1806467523550245.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46984","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.html","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.403790+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":25,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.42971","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.403790+0000\",\"flow_id\":1045261879748187,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46986,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.thtml\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.403790+0000","flow_id":"1045261879748187.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46986","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.thtml","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.406521+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":26,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.44513","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.406521+0000\",\"flow_id\":2137592322207186,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46988,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.AP\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.406521+0000","flow_id":"2137592322207186.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46988","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.AP","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.408739+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":27,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.46049","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.408739+0000\",\"flow_id\":491335652620395,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46990,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cp-1251\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.408739+0000","flow_id":"491335652620395.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46990","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cp-1251","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.411490+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":28,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.47593","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.411490+0000\",\"flow_id\":418346978395032,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46992,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.blt\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.411490+0000","flow_id":"418346978395032.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46992","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.blt","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.414228+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":29,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.49129","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.414228+0000\",\"flow_id\":984986308726290,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46994,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/.bISn4adA\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.414228+0000","flow_id":"984986308726290.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46994","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/.bISn4adA","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.416379+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":30,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.50659","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.416379+0000\",\"flow_id\":1450801281783779,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46996,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.show_query_columns\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.416379+0000","flow_id":"1450801281783779.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46996","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.show_query_columns","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.418630+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":31,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.52227","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.418630+0000\",\"flow_id\":391417533456539,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":46998,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.dtd\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.418630+0000","flow_id":"391417533456539.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"46998","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.dtd","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.429055+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":32,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.53763","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.429055+0000\",\"flow_id\":1722213150132363,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47002,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.htm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.429055+0000","flow_id":"1722213150132363.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47002","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.htm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.420714+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":33,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.55301","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.420714+0000\",\"flow_id\":1.80732651702906e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47000,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.shtm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.420714+0000","flow_id":"1807326517029060.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47000","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.shtm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.434021+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":34,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.56845","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.434021+0000\",\"flow_id\":243292701366920,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47004,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.it\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.434021+0000","flow_id":"243292701366920.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47004","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.it","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.439682+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":35,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.58379","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.439682+0000\",\"flow_id\":1495318617829748,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47006,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.INC\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.439682+0000","flow_id":"1495318617829748.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47006","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.INC","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.445037+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":36,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.59917","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.445037+0000\",\"flow_id\":429677102155680,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47008,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.jsp\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.445037+0000","flow_id":"429677102155680.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47008","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.jsp","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.449313+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":37,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.61453","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.449313+0000\",\"flow_id\":324562072555718,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47010,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.htaccess\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.449313+0000","flow_id":"324562072555718.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47010","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.htaccess","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.452773+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":38,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.62999","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.452773+0000\",\"flow_id\":1849172383425421,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47012,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.notes\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.452773+0000","flow_id":"1849172383425421.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47012","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.notes","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.455975+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":39,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.64541","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.455975+0000\",\"flow_id\":2160789440622614,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47014,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.455975+0000","flow_id":"2160789440622614.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47014","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.459533+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":40,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.66073","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.459533+0000\",\"flow_id\":124820323499370,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47016,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.snp\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.459533+0000","flow_id":"124820323499370.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47016","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.snp","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.462827+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":41,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.67609","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.462827+0000\",\"flow_id\":67126027750670,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47018,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cfm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.462827+0000","flow_id":"67126027750670.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47018","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cfm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.465956+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":42,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.69143","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.465956+0000\",\"flow_id\":1588798580987989,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47020,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.zip\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.465956+0000","flow_id":"1588798580987989.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47020","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.zip","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.468908+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":43,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.70681","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.468908+0000\",\"flow_id\":1790687813706853,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47022,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.txt\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.468908+0000","flow_id":"1790687813706853.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47022","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.txt","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.471834+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":44,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.72219","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.471834+0000\",\"flow_id\":1467865186840382,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47024,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.js0x70\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.471834+0000","flow_id":"1467865186840382.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47024","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.js0x70","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.479014+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":45,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.73763","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.479014+0000\",\"flow_id\":1815388170634565,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47026,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.bas\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.479014+0000","flow_id":"1815388170634565.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47026","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.bas","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.482231+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":46,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.75301","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.482231+0000\",\"flow_id\":2.02973710348082e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47028,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.LCDispatcher\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.482231+0000","flow_id":"2029737103480820.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47028","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.LCDispatcher","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.484832+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":47,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.76861","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.484832+0000\",\"flow_id\":1487763770335653,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47030,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.xml\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.484832+0000","flow_id":"1487763770335653.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47030","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.xml","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.490695+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":48,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.78399","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.490695+0000\",\"flow_id\":2040551831140588,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47032,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.gz\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.490695+0000","flow_id":"2040551831140588.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47032","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.gz","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.497254+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":49,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.79935","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.497254+0000\",\"flow_id\":119434434482673,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47034,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.xtp\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.497254+0000","flow_id":"119434434482673.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47034","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.xtp","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.500145+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":50,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.81471","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.500145+0000\",\"flow_id\":833747625352614,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47036,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.iso2022-kr\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.500145+0000","flow_id":"833747625352614.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47036","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.iso2022-kr","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.502204+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":51,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.83021","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.502204+0000\",\"flow_id\":1034666195461575,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47038,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.bat\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.502204+0000","flow_id":"1034666195461575.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47038","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.bat","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.504875+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":52,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.84559","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.504875+0000\",\"flow_id\":565587047264595,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47040,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.asa\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.504875+0000","flow_id":"565587047264595.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47040","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.asa","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.506877+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":53,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.86095","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.506877+0000\",\"flow_id\":1776793594542443,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47042,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.PRINT\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.506877+0000","flow_id":"1776793594542443.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47042","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.PRINT","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.509502+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":54,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.87637","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.509502+0000\",\"flow_id\":43357678780300,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47044,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.inc\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.509502+0000","flow_id":"43357678780300.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47044","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.inc","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.511939+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":55,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.89171","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.511939+0000\",\"flow_id\":111342716111856,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47046,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.ee\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.511939+0000","flow_id":"111342716111856.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47046","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.ee","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.522439+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":56,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.90705","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.522439+0000\",\"flow_id\":22535677342666,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47048,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.gif\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.522439+0000","flow_id":"22535677342666.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47048","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.gif","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.525182+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":57,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.92239","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.525182+0000\",\"flow_id\":1801949218013082,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47050,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.tmp\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.525182+0000","flow_id":"1801949218013082.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47050","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.tmp","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.527247+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":58,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.93777","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.527247+0000\",\"flow_id\":46888141850715,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47052,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.CGI\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.527247+0000","flow_id":"46888141850715.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47052","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.CGI","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.529238+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":59,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.95311","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.529238+0000\",\"flow_id\":314112417075197,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47054,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.ASP\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.529238+0000","flow_id":"314112417075197.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47054","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.ASP","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.531898+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":60,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.96847","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.531898+0000\",\"flow_id\":484214596835423,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47056,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cnf\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.531898+0000","flow_id":"484214596835423.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47056","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cnf","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.534133+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":61,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.98383","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.534133+0000\",\"flow_id\":987915476410983,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47058,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.config~\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.534133+0000","flow_id":"987915476410983.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47058","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.config~","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.536596+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":62,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.99927","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.536596+0000\",\"flow_id\":830771212987548,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47060,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.vts\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.536596+0000","flow_id":"830771212987548.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47060","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.vts","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.538865+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":63,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.101463","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.538865+0000\",\"flow_id\":2145323263342098,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47062,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.bak\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.538865+0000","flow_id":"2145323263342098.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47062","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.bak","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.541676+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":64,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.103002","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.541676+0000\",\"flow_id\":2236672922763369,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47064,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.se\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.541676+0000","flow_id":"2236672922763369.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47064","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.se","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.543712+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":65,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.104539","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.543712+0000\",\"flow_id\":2.23652689387752e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47066,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.js\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.543712+0000","flow_id":"2236526893877520.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47066","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.js","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.546419+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":66,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.106080","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.546419+0000\",\"flow_id\":565934939591600,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47068,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.pl\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.546419+0000","flow_id":"565934939591600.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47068","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.pl","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.549896+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":67,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.107615","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.549896+0000\",\"flow_id\":203104692363407,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47070,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.iso2022-jp\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.549896+0000","flow_id":"203104692363407.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47070","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.iso2022-jp","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.553708+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":68,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.109166","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.553708+0000\",\"flow_id\":1482309161872368,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47072,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.es\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.553708+0000","flow_id":"1482309161872368.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47072","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.es","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.556583+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":69,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.110703","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.556583+0000\",\"flow_id\":993915545746050,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47074,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.utf8\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.556583+0000","flow_id":"993915545746050.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47074","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.utf8","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.570703+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":70,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.112242","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.570703+0000\",\"flow_id\":304066488610493,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47076,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.php=\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.570703+0000","flow_id":"304066488610493.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47076","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.php=","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.575638+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":71,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.113781","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.575638+0000\",\"flow_id\":1484675688873005,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47078,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.dk\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.575638+0000","flow_id":"1484675688873005.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47078","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.dk","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.578131+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":72,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.115318","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.578131+0000\",\"flow_id\":1753841289317738,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47080,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.php4\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.578131+0000","flow_id":"1753841289317738.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47080","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.php4","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.581866+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":73,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.116859","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.581866+0000\",\"flow_id\":1.17482386324625e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47082,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.sh\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.581866+0000","flow_id":"1174823863246250.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47082","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.sh","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.585321+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":74,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.118400","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.585321+0000\",\"flow_id\":1629124028984059,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47084,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cfc\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.585321+0000","flow_id":"1629124028984059.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47084","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cfc","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.588333+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":75,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.119939","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.588333+0000\",\"flow_id\":1.72249232303402e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47086,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.jse\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.588333+0000","flow_id":"1722492323034020.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47086","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.jse","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.590216+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":76,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.121482","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.590216+0000\",\"flow_id\":479451478163037,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47088,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.nlm\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.590216+0000","flow_id":"479451478163037.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47088","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.nlm","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.592132+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":77,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.123019","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.592132+0000\",\"flow_id\":88759778018679,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47090,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.printer\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.592132+0000","flow_id":"88759778018679.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47090","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.printer","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.594670+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":78,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.124562","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.594670+0000\",\"flow_id\":560166798495674,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47092,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.1\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.594670+0000","flow_id":"560166798495674.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47092","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.1","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.599159+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":79,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.126095","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.599159+0000\",\"flow_id\":1422785210098109,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47094,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.pwd\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.599159+0000","flow_id":"1422785210098109.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47094","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.pwd","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.601252+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":80,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.127634","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.601252+0000\",\"flow_id\":1543190323276216,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47096,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.cp866\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.601252+0000","flow_id":"1543190323276216.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47096","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.cp866","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.603136+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":81,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.129177","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.603136+0000\",\"flow_id\":1566365966807384,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47098,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.ida\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.603136+0000","flow_id":"1566365966807384.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47098","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.ida","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.612252+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":82,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.130716","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.612252+0000\",\"flow_id\":1249779632453529,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47100,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.wwwacl\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.612252+0000","flow_id":"1249779632453529.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47100","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.wwwacl","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.616417+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":83,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.132261","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.616417+0000\",\"flow_id\":2152744966841157,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47102,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.UploadServlet\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.616417+0000","flow_id":"2152744966841157.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47102","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.UploadServlet","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.628183+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":84,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.133820","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.628183+0000\",\"flow_id\":486941901094842,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47104,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.PWD\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.628183+0000","flow_id":"486941901094842.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47104","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.PWD","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.634992+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":85,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.135357","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.634992+0000\",\"flow_id\":278614512413618,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47106,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.ml\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.634992+0000","flow_id":"278614512413618.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47106","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.ml","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.638121+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":86,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.136892","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.638121+0000\",\"flow_id\":2193388242384897,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47108,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.exe\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.638121+0000","flow_id":"2193388242384897.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47108","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.exe","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.641116+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":87,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.138431","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.641116+0000\",\"flow_id\":1061393776952083,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47110,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.listprint\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.641116+0000","flow_id":"1061393776952083.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47110","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.listprint","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.646964+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":88,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.139982","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.646964+0000\",\"flow_id\":403035420023849,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47112,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.link\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.646964+0000","flow_id":"403035420023849.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47112","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.link","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.650090+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":89,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.141521","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.650090+0000\",\"flow_id\":303031401506644,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47114,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.pt\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.650090+0000","flow_id":"303031401506644.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47114","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.pt","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.653055+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":90,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.143056","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.653055+0000\",\"flow_id\":2084777109418518,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47116,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.back\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.653055+0000","flow_id":"2084777109418518.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47116","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.back","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.655279+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":91,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.144597","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.655279+0000\",\"flow_id\":1361650645662792,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47118,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.password\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.655279+0000","flow_id":"1361650645662792.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47118","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.password","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.657354+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":92,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.146146","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.657354+0000\",\"flow_id\":1.24322121737965e+15,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47120,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.php\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.657354+0000","flow_id":"1243221217379650.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47120","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.php","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}
{"timestamp":"2020-03-04T19:18:34.659892+0000","rule":{"level":3,"description":"Suricata: Alert - SURICATA HTTP METHOD terminated by non-compliant character","id":"86601","firedtimes":93,"mail":false,"groups":["ids","suricata"]},"agent":{"id":"000","name":"user-0"},"manager":{"name":"user-0"},"id":"1587995587.147689","full_log":"{\"timestamp\":\"2020-03-04T19:18:34.659892+0000\",\"flow_id\":1976543933501226,\"in_iface\":\"eth0\",\"event_type\":\"alert\",\"src_ip\":\"192.168.10.238\",\"src_port\":47122,\"dest_ip\":\"192.168.10.154\",\"dest_port\":80,\"proto\":\"TCP\",\"tx_id\":0,\"alert\":{\"action\":\"allowed\",\"gid\":1,\"signature_id\":2221030,\"rev\":1,\"signature\":\"SURICATA HTTP METHOD terminated by non-compliant character\",\"category\":\"Generic Protocol Command Decode\",\"severity\":3},\"http\":{\"hostname\":\"mail.cup.com\",\"url\":\"/bISn4adA.tw\",\"http_user_agent\":\"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)\",\"http_content_type\":\"text/html\",\"http_method\":\"GET\",\"protocol\":\"HTTP/1.1\",\"status\":400,\"length\":226}}","decoder":{"name":"json"},"data":{"timestamp":"2020-03-04T19:18:34.659892+0000","flow_id":"1976543933501226.000000","in_iface":"eth0","event_type":"alert","src_ip":"192.168.10.238","src_port":"47122","dest_ip":"192.168.10.154","dest_port":"80","proto":"TCP","tx_id":"0","alert":{"action":"allowed","gid":"1","signature_id":"2221030","rev":"1","signature":"SURICATA HTTP METHOD terminated by non-compliant character","category":"Generic Protocol Command Decode","severity":"3"},"http":{"hostname":"mail.cup.com","url":"/bISn4adA.tw","http_user_agent":"Mozilla/5.00 (Nikto/2.1.5) (Evasions:6) (Test:map_codes)","http_content_type":"text/html","http_method":"GET","protocol":"HTTP/1.1","status":"400","length":"226"}},"location":"/var/log/forensic/suricata/eve.json"}