CERNITY / DETECTION COVERAGE Same traffic. For every detector below, the exact Suricata EVE record that triggered it sits beside the record a SOC analyst actually queries — the Elasticsearch document and the CEF event Cernity delivered. Across all of it, Suricata raised zero signature alerts.
HOW THESE WERE PRODUCED Each record is produced by running the real detector, finding-service lifecycle, and findings-forwarder over a fixture of Suricata EVE — the right-hand pane is the finalized finding as it reaches the SIEM (Elasticsearch _source and CEF), not a mock-up. It runs in-process over synthetic fixtures , so it is not a live Elasticsearch cluster or a customer incident, and the finding gate’s SUPPRESSED decisions and enrichment_state: TIMEOUT (no forensics overlay attached) are shown exactly as they occur. For end-to-end runs against a live SIEM with export hashes, see the full-pipeline cases and the optional-integration audit .
28 detectors
33 delivered to SIEM
3 suppressed as noise
0 Suricata alerts
OT / ICS — Modbus control abuse ↓ Encrypted-traffic & protocol behavior ↓ Web-attack request shapes ↓ DNS behavior — DGA & NXDOMAIN bursts ↓ Windows / AD lateral movement ↓ Sensor coverage health ↓ Protocol-integrity anomalies ↓ OT / ICS — Modbus control abuse Suricata natively decodes Modbus to EVE but raises no alert on protocol misuse — there is no signature for “a master that should not be writing.” Cernity learns the authorized masters per outstation and scores the behavior.
SURICATA BASELINE 21 EVE records 0 alerts → CERNITY → SIEM 12 delivered
program_download sev 9 ics_control T0858 T0843 DELIVERED → SIEM
program/mode transfer fc=90 A program-download / operating-mode-change code a normal polling loop never issues, from a non-EWS source.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:07+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.98" , "dest_ip" : "10.0.7.10" , "dest_port" : 502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 90 }, "access" : "WRITE" , "unit_id" : 1 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:program_download-178720555-497107:r2" , "_source" : { "finding_id" : "program_download-178720555-497107" , "tenant_id" : "default" , "detector_id" : "program_download" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 9 , "confidence" : 0.8 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.98 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" program/mode transfer fc=90 \" }, { \" type \" : \" modbus_fc \" , \" value \" : 90}]" , "state" : "FINAL" , "mitre" : [ "T0858" , "T0843" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|program_download|ics_control|9|cs1=program_download-178720555-497107 cs1Label=findingId cs2=T0858,T0843 cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.98 dst=10.0.7.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "program_download-178720555-497107" , "tenant_id" : "default" , "detector_id" : "program_download" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 9 , "confidence" : 0.8 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.98 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" program/mode transfer fc=90 \" }, { \" type \" : \" modbus_fc \" , \" value \" : 90}]" , "state" : "CANDIDATE" , "mitre" : [ "T0858" , "T0843" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.98" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.10" }, { "type" : "why" , "value" : "program/mode transfer fc=90" }, { "type" : "modbus_fc" , "value" : 90 } ] } WHAT TO INVESTIGATE Correlate with a change-management window. Verify the source is authorized to reprogram the PLC. unauthorized_write sev 8 ics_control T0855 T0831 fired 2× DELIVERED → SIEM
unauthorized write fc=16 access=WRITE_MULTIPLE A write/control function code from a source not in the learned authorized-masters set for that outstation.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:06+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.99" , "dest_ip" : "10.0.7.10" , "dest_port" : 502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 16 }, "access" : "WRITE_MULTIPLE" , "unit_id" : 1 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:unauthorized_write-7408133162-497107:r2" , "_source" : { "finding_id" : "unauthorized_write-7408133162-497107" , "tenant_id" : "default" , "detector_id" : "unauthorized_write" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.99 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" unauthorized write fc=16 access=WRITE_MULTIPLE \" }, { \" type \" : \" modbus_fc \" , \" value \" : 16}]" , "state" : "FINAL" , "mitre" : [ "T0855" , "T0831" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|unauthorized_write|ics_control|8|cs1=unauthorized_write-7408133162-497107 cs1Label=findingId cs2=T0855,T0831 cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.99 dst=10.0.7.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "unauthorized_write-7408133162-497107" , "tenant_id" : "default" , "detector_id" : "unauthorized_write" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.99 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" unauthorized write fc=16 access=WRITE_MULTIPLE \" }, { \" type \" : \" modbus_fc \" , \" value \" : 16}]" , "state" : "CANDIDATE" , "mitre" : [ "T0855" , "T0831" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.99" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.10" }, { "type" : "why" , "value" : "unauthorized write fc=16 access=WRITE_MULTIPLE" }, { "type" : "modbus_fc" , "value" : 16 } ] } WHAT TO INVESTIGATE Confirm whether the source is a sanctioned EWS/HMI; if so, pin it. Check the outstation process context for the written registers/coils. fc_enumeration sev 6 ics_control T0846 fired 3× DELIVERED → SIEM
unit enumeration: 4 distinct unit IDs One source touching an abnormal breadth of function codes / unit IDs — reconnaissance of the outstation.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:11+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.88" , "dest_ip" : "10.0.7.10" , "dest_port" : 502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 4 }, "access" : "READ" , "unit_id" : 4 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:fc_enumeration-6192455714-497107:r2" , "_source" : { "finding_id" : "fc_enumeration-6192455714-497107" , "tenant_id" : "default" , "detector_id" : "fc_enumeration" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.88 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" unit enumeration: 4 distinct unit IDs \" }]" , "state" : "FINAL" , "mitre" : [ "T0846" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|fc_enumeration|ics_control|6|cs1=fc_enumeration-6192455714-497107 cs1Label=findingId cs2=T0846 cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.88 dst=10.0.7.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "fc_enumeration-6192455714-497107" , "tenant_id" : "default" , "detector_id" : "fc_enumeration" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.88 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" unit enumeration: 4 distinct unit IDs \" }]" , "state" : "CANDIDATE" , "mitre" : [ "T0846" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.88" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.10" }, { "type" : "why" , "value" : "unit enumeration: 4 distinct unit IDs" } ] } WHAT TO INVESTIGATE Identify the source host and process. Confirm whether a legitimate scan/inventory job is running. modbus_port_anomaly sev 6 ics_control T0885 DELIVERED → SIEM
modbus on port 1502 (expected 502) A Modbus transaction on a port other than 502 — the protocol where it is not expected.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:19+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.66" , "dest_ip" : "10.0.7.11" , "dest_port" : 1502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 3 }, "access" : "READ" , "unit_id" : 1 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:modbus_port_anomaly-2829169827-497107:r2" , "_source" : { "finding_id" : "modbus_port_anomaly-2829169827-497107" , "tenant_id" : "default" , "detector_id" : "modbus_port_anomaly" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.66 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.11 \" }, { \" type \" : \" why \" , \" value \" : \" modbus on port 1502 (expected 502) \" }]" , "state" : "FINAL" , "mitre" : [ "T0885" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|modbus_port_anomaly|ics_control|6|cs1=modbus_port_anomaly-2829169827-497107 cs1Label=findingId cs2=T0885 cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.66 dst=10.0.7.11 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "modbus_port_anomaly-2829169827-497107" , "tenant_id" : "default" , "detector_id" : "modbus_port_anomaly" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.66 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.11 \" }, { \" type \" : \" why \" , \" value \" : \" modbus on port 1502 (expected 502) \" }]" , "state" : "CANDIDATE" , "mitre" : [ "T0885" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.66" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.11" }, { "type" : "why" , "value" : "modbus on port 1502 (expected 502)" } ] } WHAT TO INVESTIGATE Confirm whether a non-standard Modbus port is sanctioned here. Inspect the endpoint offering Modbus off-port. error_flag_spike sev 5 ics_control DELIVERED → SIEM
5 modbus exceptions in window A burst of Modbus exceptions (illegal function / illegal data address) — probing or misconfiguration.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:14+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.77" , "dest_ip" : "10.0.7.10" , "dest_port" : 502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 3 }, "access" : "READ" , "unit_id" : 1 , "exception" : "ILLEGAL_FUNCTION" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:error_flag_spike-7551433892-497107:r2" , "_source" : { "finding_id" : "error_flag_spike-7551433892-497107" , "tenant_id" : "default" , "detector_id" : "error_flag_spike" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.77 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" 5 modbus exceptions in window \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|error_flag_spike|ics_control|5|cs1=error_flag_spike-7551433892-497107 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.77 dst=10.0.7.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "error_flag_spike-7551433892-497107" , "tenant_id" : "default" , "detector_id" : "error_flag_spike" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.77 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" 5 modbus exceptions in window \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.77" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.10" }, { "type" : "why" , "value" : "5 modbus exceptions in window" } ] } WHAT TO INVESTIGATE Check whether the source is mis-scoped polling or deliberate probing. Review the outstation for configuration drift. new_master_pairing sev 5 ics_control T0842 T0859 fired 4× DELIVERED → SIEM
master never seen for this outstation A master that has never before spoken Modbus to this outstation — a novel control relationship.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:06+00:00" , "event_type" : "modbus" , "src_ip" : "10.0.7.99" , "dest_ip" : "10.0.7.10" , "dest_port" : 502 , "proto" : "TCP" , "modbus" : { "function" : { "code" : 16 }, "access" : "WRITE_MULTIPLE" , "unit_id" : 1 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:new_master_pairing-790643726-497107:r2" , "_source" : { "finding_id" : "new_master_pairing-790643726-497107" , "tenant_id" : "default" , "detector_id" : "new_master_pairing" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.99 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" master never seen for this outstation \" }]" , "state" : "FINAL" , "mitre" : [ "T0842" , "T0859" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|new_master_pairing|ics_control|5|cs1=new_master_pairing-790643726-497107 cs1Label=findingId cs2=T0842,T0859 cs2Label=mitre cs3=default cs3Label=tenant cat=ics_control src=10.0.7.99 dst=10.0.7.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "new_master_pairing-790643726-497107" , "tenant_id" : "default" , "detector_id" : "new_master_pairing" , "detector_version" : "1.0" , "category" : "ics_control" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.7.99 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.7.10 \" }, { \" type \" : \" why \" , \" value \" : \" master never seen for this outstation \" }]" , "state" : "CANDIDATE" , "mitre" : [ "T0842" , "T0859" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.7.99" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.7.10" }, { "type" : "why" , "value" : "master never seen for this outstation" } ] } WHAT TO INVESTIGATE Determine whether the pairing is a newly commissioned device. Check what function codes the new master issued.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish Requires a sensor tapped on an OT segment with the Modbus parser enabled. The authorized-masters baseline is learn-on-observe, so a novel master’s first control op is the alertable moment.
Encrypted-traffic & protocol behavior None of these trip a signature. Cernity scores behavior across the TLS/HTTP/SSH/flow metadata Suricata already emits — fingerprint rarity, evasion, and exfil tells.
SURICATA BASELINE 27 EVE records 0 alerts → CERNITY → SIEM 6 delivered 2 suppressed as noise
icmp_exfil sev 7 exfil DELIVERED → SIEM
2000000 bytes Large ICMP volume to an external destination — tunneling / covert exfil.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:02:00+00:00" , "event_type" : "flow" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.20" , "proto" : "ICMP" , "flow" : { "bytes_toserver" : 2000000 , "bytes_toclient" : 0 } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:icmp_exfil-2570754831-497107:r2" , "_source" : { "finding_id" : "icmp_exfil-2570754831-497107" , "tenant_id" : "default" , "detector_id" : "icmp_exfil" , "detector_version" : "1.0" , "category" : "exfil" , "severity" : 7 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.20 \" }, { \" type \" : \" bytes \" , \" value \" : 2000000}]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "TA0010" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|icmp_exfil|exfil|7|cs1=icmp_exfil-2570754831-497107 cs1Label=findingId cs2=TA0010 cs2Label=mitre cs3=default cs3Label=tenant cat=exfil src=10.0.0.5 dst=203.0.113.20 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "icmp_exfil-2570754831-497107" , "tenant_id" : "default" , "detector_id" : "icmp_exfil" , "detector_version" : "1.0" , "category" : "exfil" , "severity" : 7 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.20 \" }, { \" type \" : \" bytes \" , \" value \" : 2000000}]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.20" }, { "type" : "bytes" , "value" : 2000000 } ] } WHAT TO INVESTIGATE Inspect ICMP payload sizes and periodicity. Confirm the destination is not a monitoring endpoint. ssh_bruteforce sev 6 credential_access DELIVERED → SIEM
15 attempts Many short SSH sessions from one source to one destination — credential guessing.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:01:15+00:00" , "event_type" : "ssh" , "src_ip" : "10.0.0.7" , "dest_ip" : "10.0.0.8" , "dest_port" : 22 } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:ssh_bruteforce-9847450500-497107:r1" , "_source" : { "finding_id" : "ssh_bruteforce-9847450500-497107" , "tenant_id" : "default" , "detector_id" : "ssh_bruteforce" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.7 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.0.8 \" }, { \" type \" : \" attempts \" , \" value \" : 15}]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 1 , "mitre" : [ "T1110" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "NOT_REQUIRED" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|ssh_bruteforce|credential_access|6|cs1=ssh_bruteforce-9847450500-497107 cs1Label=findingId cs2=T1110 cs2Label=mitre cs3=default cs3Label=tenant cat=credential_access src=10.0.0.7 dst=10.0.0.8 cs4=1 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "ssh_bruteforce-9847450500-497107" , "tenant_id" : "default" , "detector_id" : "ssh_bruteforce" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.7 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 10.0.0.8 \" }, { \" type \" : \" attempts \" , \" value \" : 15}]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.7" }, { "type" : "ip" , "role" : "dst" , "value" : "10.0.0.8" }, { "type" : "attempts" , "value" : 15 } ] } WHAT TO INVESTIGATE Check the target’s auth logs for any success. Confirm the source is not a sanctioned automation host. cloud_staging sev 5 exfil DELIVERED → SIEM
data-staging destination: dl.dropboxusercontent.com TLS SNI to a data-sharing / cloud-storage host — a common exfil staging destination.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:07+00:00" , "event_type" : "tls" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.12" , "dest_port" : 443 , "tls" : { "sni" : "dl.dropboxusercontent.com" , "ja4" : "t13d_warm_1" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:cloud_staging-212857535-497107:r2" , "_source" : { "finding_id" : "cloud_staging-212857535-497107" , "tenant_id" : "default" , "detector_id" : "cloud_staging" , "detector_version" : "1.0" , "category" : "exfil" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" sni \" , \" value \" : \" dl.dropboxusercontent.com \" }, { \" type \" : \" service \" , \" value \" : \" dropboxusercontent \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "TA0010" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|cloud_staging|exfil|5|cs1=cloud_staging-212857535-497107 cs1Label=findingId cs2=TA0010 cs2Label=mitre cs3=default cs3Label=tenant cat=exfil src=10.0.0.5 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "cloud_staging-212857535-497107" , "tenant_id" : "default" , "detector_id" : "cloud_staging" , "detector_version" : "1.0" , "category" : "exfil" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" sni \" , \" value \" : \" dl.dropboxusercontent.com \" }, { \" type \" : \" service \" , \" value \" : \" dropboxusercontent \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "sni" , "value" : "dl.dropboxusercontent.com" }, { "type" : "service" , "value" : "dropboxusercontent" } ] } WHAT TO INVESTIGATE Check whether the destination is an approved service for this host. Review volume and direction of the transfer. ja4_rarity sev 5 c2 DELIVERED → SIEM
never-before-seen JA4 client → evil.example A TLS client fingerprint the whole fleet has not seen before, past a warm-up.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:06+00:00" , "event_type" : "tls" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.11" , "dest_port" : 443 , "tls" : { "sni" : "evil.example" , "ja4" : "t13d_never_seen_before" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:ja4_rarity-4524396965-497107:r2" , "_source" : { "finding_id" : "ja4_rarity-4524396965-497107" , "tenant_id" : "default" , "detector_id" : "ja4_rarity" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ja4 \" , \" value \" : \" t13d_never_seen_before \" }, { \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" sni \" , \" value \" : \" evil.example \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|ja4_rarity|c2|5|cs1=ja4_rarity-4524396965-497107 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 src=10.0.0.5 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "ja4_rarity-4524396965-497107" , "tenant_id" : "default" , "detector_id" : "ja4_rarity" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ja4 \" , \" value \" : \" t13d_never_seen_before \" }, { \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" sni \" , \" value \" : \" evil.example \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ja4" , "value" : "t13d_never_seen_before" }, { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "sni" , "value" : "evil.example" } ] } WHAT TO INVESTIGATE Identify the client software and whether it is sanctioned. Check the destination and SNI for the rare client. tls_cert_anomaly sev 5 c2 DELIVERED → SIEM
self_signed A self-signed or very short-lived certificate — a frequent C2/malware tell.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:09+00:00" , "event_type" : "tls" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.14" , "dest_port" : 443 , "tls" : { "sni" : "selfsigned.example" , "ja4" : "t13d_warm_3" , "subject" : "CN=evil" , "issuer" : "CN=evil" , "notbefore" : "2026-01-01T00:00:00Z" , "notafter" : "2027-01-01T00:00:00Z" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:tls_cert_anomaly-6800292006-497107:r2" , "_source" : { "finding_id" : "tls_cert_anomaly-6800292006-497107" , "tenant_id" : "default" , "detector_id" : "tls_cert_anomaly" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.14 \" }, { \" type \" : \" sni \" , \" value \" : \" selfsigned.example \" }, { \" type \" : \" why \" , \" value \" : \" self_signed \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|tls_cert_anomaly|c2|5|cs1=tls_cert_anomaly-6800292006-497107 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 dst=203.0.113.14 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "tls_cert_anomaly-6800292006-497107" , "tenant_id" : "default" , "detector_id" : "tls_cert_anomaly" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.14 \" }, { \" type \" : \" sni \" , \" value \" : \" selfsigned.example \" }, { \" type \" : \" why \" , \" value \" : \" self_signed \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.14" }, { "type" : "sni" , "value" : "selfsigned.example" }, { "type" : "why" , "value" : "self_signed" } ] } WHAT TO INVESTIGATE Inspect the certificate subject/issuer and the destination. Correlate with fingerprint rarity on the same flow. doh_detect sev 4 defense_evasion SUPPRESSED (noise)
doh:cloudflare-dns.com DNS-over-HTTPS/TLS to a resolver not on the approved list — DNS visibility evasion.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:08+00:00" , "event_type" : "tls" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.13" , "dest_port" : 443 , "tls" : { "sni" : "cloudflare-dns.com" , "ja4" : "t13d_warm_2" } } CERNITY LIFECYCLE · NOT DELIVERED The gate withheld this from the analyst plane
state: SUPPRESSED · devo_delivery_state: NONE
low-severity (4) non-threat finding; kept for correlation and audit, not delivered
Kept in the store for correlation and hunting — it does not add to the analyst's queue. This is how the finding gate reduces SIEM volume instead of only re-ranking it.
Detector output before the lifecycle (raw candidate) { "finding_id" : "doh_detect-194091769-497107" , "tenant_id" : "default" , "detector_id" : "doh_detect" , "detector_version" : "1.0" , "category" : "defense_evasion" , "severity" : 4 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" sni \" , \" value \" : \" cloudflare-dns.com \" }, { \" type \" : \" why \" , \" value \" : \" doh:cloudflare-dns.com \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "sni" , "value" : "cloudflare-dns.com" }, { "type" : "why" , "value" : "doh:cloudflare-dns.com" } ] } WHAT TO INVESTIGATE Confirm whether DoH is sanctioned for this host. Check what the host resolved before switching to DoH. port_proto_mismatch sev 4 defense_evasion SUPPRESSED (noise)
ssh on port 443 (expected tls) Suricata detected an application protocol that contradicts the well-known service for the port.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:02:01+00:00" , "event_type" : "ssh" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.21" , "dest_port" : 443 } CERNITY LIFECYCLE · NOT DELIVERED The gate withheld this from the analyst plane
state: SUPPRESSED · devo_delivery_state: NONE
low-severity (4) non-threat finding; kept for correlation and audit, not delivered
Kept in the store for correlation and hunting — it does not add to the analyst's queue. This is how the finding gate reduces SIEM volume instead of only re-ranking it.
Detector output before the lifecycle (raw candidate) { "finding_id" : "port_proto_mismatch-847898558-497107" , "tenant_id" : "default" , "detector_id" : "port_proto_mismatch" , "detector_version" : "1.0" , "category" : "defense_evasion" , "severity" : 4 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.21 \" }, { \" type \" : \" why \" , \" value \" : \" ssh on port 443 (expected tls) \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.21" }, { "type" : "why" , "value" : "ssh on port 443 (expected tls)" } ] } WHAT TO INVESTIGATE Confirm whether tunneling on this port is sanctioned. Inspect the flow’s true application protocol. suspicious_ua sev 4 c2 DELIVERED → SIEM
non-browser tooling user-agent: curl/ A non-browser tooling user-agent (curl, python-requests, powershell…) to an external host.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:10+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.15" , "dest_port" : 80 , "http" : { "http_user_agent" : "curl/8.4.0" , "hostname" : "x" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:suspicious_ua-8710322746-497107:r2" , "_source" : { "finding_id" : "suspicious_ua-8710322746-497107" , "tenant_id" : "default" , "detector_id" : "suspicious_ua" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 4 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.15 \" }, { \" type \" : \" ua \" , \" value \" : \" curl/ \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:32Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|suspicious_ua|c2|4|cs1=suspicious_ua-8710322746-497107 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 src=10.0.0.5 dst=203.0.113.15 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "suspicious_ua-8710322746-497107" , "tenant_id" : "default" , "detector_id" : "suspicious_ua" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 4 , "confidence" : 0.5 , "first_seen" : "2026-09-16T19:50:32Z" , "last_seen" : "2026-09-16T19:50:32Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.15 \" }, { \" type \" : \" ua \" , \" value \" : \" curl/ \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.15" }, { "type" : "ua" , "value" : "curl/" } ] } WHAT TO INVESTIGATE Identify the process generating the request. Check whether the destination is an approved API/CDN.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish Rarity depends on a warm-up window; a rare fingerprint or new client is a lead, not attribution. Server-side fingerprint and ECH/domain-fronting are additional detectors not exercised by this fixture.
Web-attack request shapes Without a matching rule, Suricata logs these as ordinary HTTP. Cernity names the request shape — and leaves the benign request alone.
SURICATA BASELINE 7 EVE records 0 alerts → CERNITY → SIEM 5 delivered 1 suppressed as noise
http_cmd_injection sev 8 exploit DELIVERED → SIEM
command-injection pattern in URI Shell-command syntax in the request — OS command injection attempt.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:02+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "GET" , "url" : "/ping?host=8.8.8.8;cat /etc/shadow" , "hostname" : "vhost" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:http_cmd_injection-1178650702-2982647:r2" , "_source" : { "finding_id" : "http_cmd_injection-1178650702-2982647" , "tenant_id" : "default" , "detector_id" : "http_cmd_injection" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /ping?host=8.8.8.8;cat /etc/shadow \" }, { \" type \" : \" why \" , \" value \" : \" command-injection pattern in URI \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|http_cmd_injection|exploit|8|cs1=http_cmd_injection-1178650702-2982647 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=exploit src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "http_cmd_injection-1178650702-2982647" , "tenant_id" : "default" , "detector_id" : "http_cmd_injection" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /ping?host=8.8.8.8;cat /etc/shadow \" }, { \" type \" : \" why \" , \" value \" : \" command-injection pattern in URI \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/ping?host=8.8.8.8;cat /etc/shadow" }, { "type" : "why" , "value" : "command-injection pattern in URI" } ] } WHAT TO INVESTIGATE Check the server response for command output. Confirm the endpoint shells out to the OS. http_webshell sev 8 malware DELIVERED → SIEM
webshell / backdoor URI A request shape consistent with webshell / backdoor interaction.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "GET" , "url" : "/uploads/shell.php?cmd=id" , "hostname" : "vhost" , "http_content_type" : "text/html" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:http_webshell-662598296-2982647:r2" , "_source" : { "finding_id" : "http_webshell-662598296-2982647" , "tenant_id" : "default" , "detector_id" : "http_webshell" , "detector_version" : "1.0" , "category" : "malware" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /uploads/shell.php?cmd=id \" }, { \" type \" : \" why \" , \" value \" : \" webshell / backdoor URI \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|http_webshell|malware|8|cs1=http_webshell-662598296-2982647 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=malware src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "http_webshell-662598296-2982647" , "tenant_id" : "default" , "detector_id" : "http_webshell" , "detector_version" : "1.0" , "category" : "malware" , "severity" : 8 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /uploads/shell.php?cmd=id \" }, { \" type \" : \" why \" , \" value \" : \" webshell / backdoor URI \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/uploads/shell.php?cmd=id" }, { "type" : "why" , "value" : "webshell / backdoor URI" } ] } WHAT TO INVESTIGATE Check the server response code and body size. Confirm whether the target path exists. http_path_traversal sev 7 exploit DELIVERED → SIEM
path-traversal / LFI pattern Directory-traversal / LFI syntax targeting files outside the web root.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:03+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "GET" , "url" : "/download?f=../../../../etc/passwd" , "hostname" : "vhost" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:http_path_traversal-1902775401-2982647:r2" , "_source" : { "finding_id" : "http_path_traversal-1902775401-2982647" , "tenant_id" : "default" , "detector_id" : "http_path_traversal" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /download?f=../../../../etc/passwd \" }, { \" type \" : \" why \" , \" value \" : \" path-traversal / LFI pattern \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|http_path_traversal|exploit|7|cs1=http_path_traversal-1902775401-2982647 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=exploit src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "http_path_traversal-1902775401-2982647" , "tenant_id" : "default" , "detector_id" : "http_path_traversal" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /download?f=../../../../etc/passwd \" }, { \" type \" : \" why \" , \" value \" : \" path-traversal / LFI pattern \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/download?f=../../../../etc/passwd" }, { "type" : "why" , "value" : "path-traversal / LFI pattern" } ] } WHAT TO INVESTIGATE Check whether the traversal returned file contents. Confirm the path handler sanitizes input. http_sqli sev 7 exploit DELIVERED → SIEM
SQL-injection pattern in URI SQL-injection syntax in the request — an injection attempt against the backend.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:01+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "GET" , "url" : "/item?id=1' or '1'='1" , "hostname" : "vhost" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:http_sqli-1187673266-2982647:r2" , "_source" : { "finding_id" : "http_sqli-1187673266-2982647" , "tenant_id" : "default" , "detector_id" : "http_sqli" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /item?id=1' or '1'='1 \" }, { \" type \" : \" why \" , \" value \" : \" SQL-injection pattern in URI \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|http_sqli|exploit|7|cs1=http_sqli-1187673266-2982647 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=exploit src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "http_sqli-1187673266-2982647" , "tenant_id" : "default" , "detector_id" : "http_sqli" , "detector_version" : "1.0" , "category" : "exploit" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /item?id=1' or '1'='1 \" }, { \" type \" : \" why \" , \" value \" : \" SQL-injection pattern in URI \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/item?id=1' or '1'='1" }, { "type" : "why" , "value" : "SQL-injection pattern in URI" } ] } WHAT TO INVESTIGATE Check whether the query executed or errored server-side. Confirm the parameter reaches a database. http_cred_in_url sev 5 credential_access SUPPRESSED (noise)
credential in URL query Credentials passed in the URL query string — exposure and a weak-auth signal.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:04+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "GET" , "url" : "/login?user=admin&password=hunter2" , "hostname" : "vhost" } } CERNITY LIFECYCLE · NOT DELIVERED The gate withheld this from the analyst plane
state: SUPPRESSED · devo_delivery_state: NONE
low-severity (5) non-threat finding; kept for correlation and audit, not delivered
Kept in the store for correlation and hunting — it does not add to the analyst's queue. This is how the finding gate reduces SIEM volume instead of only re-ranking it.
Detector output before the lifecycle (raw candidate) { "finding_id" : "http_cred_in_url-267487105-2982647" , "tenant_id" : "default" , "detector_id" : "http_cred_in_url" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 5 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /login?user=admin&password=hunter2 \" }, { \" type \" : \" why \" , \" value \" : \" credential in URL query \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/login?user=admin&password=hunter2" }, { "type" : "why" , "value" : "credential in URL query" } ] } WHAT TO INVESTIGATE Confirm whether the endpoint accepts query-string auth. Rotate any exposed credential. http_suspicious_method sev 5 c2 DELIVERED → SIEM
uncommon HTTP method PUT An uncommon/risky HTTP method (PUT, PROPFIND, WebDAV) — often used to plant files.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:05+00:00" , "event_type" : "http" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "dest_port" : 80 , "http" : { "http_method" : "PUT" , "url" : "/webdav/x.jsp" , "hostname" : "vhost" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:http_suspicious_method-9149090492-2982647:r2" , "_source" : { "finding_id" : "http_suspicious_method-9149090492-2982647" , "tenant_id" : "default" , "detector_id" : "http_suspicious_method" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /webdav/x.jsp \" }, { \" type \" : \" why \" , \" value \" : \" uncommon HTTP method PUT \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|http_suspicious_method|c2|5|cs1=http_suspicious_method-9149090492-2982647 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "http_suspicious_method-9149090492-2982647" , "tenant_id" : "default" , "detector_id" : "http_suspicious_method" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 5 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" host \" , \" value \" : \" vhost \" }, { \" type \" : \" uri \" , \" value \" : \" /webdav/x.jsp \" }, { \" type \" : \" why \" , \" value \" : \" uncommon HTTP method PUT \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "host" , "value" : "vhost" }, { "type" : "uri" , "value" : "/webdav/x.jsp" }, { "type" : "why" , "value" : "uncommon HTTP method PUT" } ] } WHAT TO INVESTIGATE Check whether the method is enabled on the target. Confirm no file was written.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish A matched request shape does not establish successful exploitation, only that the request looked like an attack. Response code and reachability decide.
DNS behavior — DGA & NXDOMAIN bursts Suricata logs each DNS query/response. Cernity scores the domain string for algorithmic generation and aggregates failures per host — behavior no single record reveals.
SURICATA BASELINE 21 EVE records 0 alerts → CERNITY → SIEM 2 delivered
dga_domain sev 6 c2 DELIVERED → SIEM
DGA score 0.741 A queried name scoring high on algorithmic-generation heuristics — possible C2 rendezvous.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "dns" , "src_ip" : "10.0.0.9" , "dest_ip" : "10.0.0.1" , "dns" : { "type" : "query" , "rrname" : "vhrtbxlqkm.net" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:dga_domain-3453270880-2982647:r2" , "_source" : { "finding_id" : "dga_domain-3453270880-2982647" , "tenant_id" : "default" , "detector_id" : "dga_domain" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 6 , "confidence" : 0.741 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.9 \" }, { \" type \" : \" domain \" , \" value \" : \" vhrtbxlqkm.net \" }, { \" type \" : \" dga_label \" , \" value \" : \" vhrtbxlqkm \" }, { \" type \" : \" dga_score \" , \" value \" : 0.741}]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|dga_domain|c2|6|cs1=dga_domain-3453270880-2982647 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 src=10.0.0.9 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "dga_domain-3453270880-2982647" , "tenant_id" : "default" , "detector_id" : "dga_domain" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 6 , "confidence" : 0.741 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.9 \" }, { \" type \" : \" domain \" , \" value \" : \" vhrtbxlqkm.net \" }, { \" type \" : \" dga_label \" , \" value \" : \" vhrtbxlqkm \" }, { \" type \" : \" dga_score \" , \" value \" : 0.741}]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.9" }, { "type" : "domain" , "value" : "vhrtbxlqkm.net" }, { "type" : "dga_label" , "value" : "vhrtbxlqkm" }, { "type" : "dga_score" , "value" : 0.741 } ] } WHAT TO INVESTIGATE Resolve whether the domain belongs to a known CDN/cloud provider. Identify the process making the query. nxdomain_burst sev 6 c2 DELIVERED → SIEM
20 NXDOMAIN in window One host generating many non-existent-domain answers in a window — DGA resolution / C2 discovery.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "dns" , "src_ip" : "10.0.0.9" , "dest_ip" : "10.0.0.1" , "dns" : { "type" : "query" , "rrname" : "vhrtbxlqkm.net" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:nxdomain_burst-3150726969-2982647:r2" , "_source" : { "finding_id" : "nxdomain_burst-3150726969-2982647" , "tenant_id" : "default" , "detector_id" : "nxdomain_burst" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.9 \" }, { \" type \" : \" nxdomain_count \" , \" value \" : 20}, { \" type \" : \" window_secs \" , \" value \" : 300}]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [ "T1071" ], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|nxdomain_burst|c2|6|cs1=nxdomain_burst-3150726969-2982647 cs1Label=findingId cs2=T1071 cs2Label=mitre cs3=default cs3Label=tenant cat=c2 src=10.0.0.9 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "nxdomain_burst-3150726969-2982647" , "tenant_id" : "default" , "detector_id" : "nxdomain_burst" , "detector_version" : "1.0" , "category" : "c2" , "severity" : 6 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.9 \" }, { \" type \" : \" nxdomain_count \" , \" value \" : 20}, { \" type \" : \" window_secs \" , \" value \" : 300}]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.9" }, { "type" : "nxdomain_count" , "value" : 20 }, { "type" : "window_secs" , "value" : 300 } ] } WHAT TO INVESTIGATE Identify the process generating the burst. Correlate with any domain that did resolve.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish DGA scoring is a heuristic; long random-looking CDN subdomains can score high. Confirmation needs the resolving process and whether the domain is attacker-controlled.
Windows / AD lateral movement A flat network never generates this, and Suricata raises no alert on it. Cernity aggregates the Kerberos/SMB/LLMNR metadata into named ATT&CK techniques.
SURICATA BASELINE 25 EVE records 0 alerts → CERNITY → SIEM 4 delivered
kerberoasting sev 8 credential_access T1558.003 DELIVERED → SIEM
8 distinct SPNs requested, RC4 Many service-ticket requests with weak (RC4) encryption from one source — offline-crackable tickets.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:10+00:00" , "event_type" : "krb5" , "src_ip" : "10.0.0.77" , "dest_ip" : "10.0.0.14" , "krb5" : { "msg_type" : "KRB_TGS_REQ" , "sname" : "MSSQLSvc/sql01" , "encryption" : "23" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:kerberoasting-679941760-2982647:r1" , "_source" : { "finding_id" : "kerberoasting-679941760-2982647" , "tenant_id" : "default" , "detector_id" : "kerberoasting" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 8 , "confidence" : 0.8 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.77 \" }, { \" type \" : \" kerberoast \" , \" distinct_spns \" : 8, \" rc4 \" : true}]" , "state" : "FINAL" , "mitre" : [ "T1558.003" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 1 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "NOT_REQUIRED" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|kerberoasting|credential_access|8|cs1=kerberoasting-679941760-2982647 cs1Label=findingId cs2=T1558.003 cs2Label=mitre cs3=default cs3Label=tenant cat=credential_access src=10.0.0.77 cs4=1 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "kerberoasting-679941760-2982647" , "tenant_id" : "default" , "detector_id" : "kerberoasting" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 8 , "confidence" : 0.8 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.77 \" }, { \" type \" : \" kerberoast \" , \" distinct_spns \" : 8, \" rc4 \" : true}]" , "state" : "CANDIDATE" , "mitre" : [ "T1558.003" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.77" }, { "type" : "kerberoast" , "distinct_spns" : 8 , "rc4" : true } ] } WHAT TO INVESTIGATE Map the source to a host/account; confirm the SPN requests are expected. Review the targeted service accounts for weak passwords. lateral_exec sev 7 lateral T1021.002 DELIVERED → SIEM
pipe:svcctl (service control (PsExec)) Access to a remote-exec named pipe (svcctl / atsvc / winreg) — PsExec-style lateral movement.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:30+00:00" , "event_type" : "smb" , "src_ip" : "10.0.0.88" , "dest_ip" : "10.0.0.20" , "smb" : { "command" : "SMB2_CREATE" , "named_pipe" : " \\ PIPE \\ svcctl" , "status" : "STATUS_SUCCESS" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:lateral_exec-9089190519-2982647:r1" , "_source" : { "finding_id" : "lateral_exec-9089190519-2982647" , "tenant_id" : "default" , "detector_id" : "lateral_exec" , "detector_version" : "1.0" , "category" : "lateral" , "severity" : 7 , "confidence" : 0.75 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.88 \" }, { \" type \" : \" lateral_exec \" , \" signals \" : [ \" pipe:svcctl (service control (PsExec)) \" ]}]" , "state" : "FINAL" , "mitre" : [ "T1021.002" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 1 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "NOT_REQUIRED" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|lateral_exec|lateral|7|cs1=lateral_exec-9089190519-2982647 cs1Label=findingId cs2=T1021.002 cs2Label=mitre cs3=default cs3Label=tenant cat=lateral src=10.0.0.88 cs4=1 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "lateral_exec-9089190519-2982647" , "tenant_id" : "default" , "detector_id" : "lateral_exec" , "detector_version" : "1.0" , "category" : "lateral" , "severity" : 7 , "confidence" : 0.75 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.88 \" }, { \" type \" : \" lateral_exec \" , \" signals \" : [ \" pipe:svcctl (service control (PsExec)) \" ]}]" , "state" : "CANDIDATE" , "mitre" : [ "T1021.002" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.88" }, { "type" : "lateral_exec" , "signals" : [ "pipe:svcctl (service control (PsExec))" ] } ] } WHAT TO INVESTIGATE Map source and destination hosts and the invoking account. Confirm whether remote administration is expected between them. llmnr_poison sev 7 credential_access T1557.001 DELIVERED → SIEM
6 names answered (not owned) A host answering LLMNR/mDNS name queries it does not own — Responder-style credential capture.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "dns" , "src_ip" : "10.0.0.66" , "dest_ip" : "10.0.0.10" , "dest_port" : 5355 , "proto" : "UDP" , "dns" : { "type" : "answer" , "rrname" : "WPAD" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:llmnr_poison-2289960405-2982647:r1" , "_source" : { "finding_id" : "llmnr_poison-2289960405-2982647" , "tenant_id" : "default" , "detector_id" : "llmnr_poison" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 7 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" responder \" , \" value \" : \" 10.0.0.66 \" }, { \" type \" : \" llmnr \" , \" answered_names \" : 6}]" , "state" : "FINAL" , "mitre" : [ "T1557.001" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 1 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "NOT_REQUIRED" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|llmnr_poison|credential_access|7|cs1=llmnr_poison-2289960405-2982647 cs1Label=findingId cs2=T1557.001 cs2Label=mitre cs3=default cs3Label=tenant cat=credential_access src=10.0.0.66 cs4=1 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "llmnr_poison-2289960405-2982647" , "tenant_id" : "default" , "detector_id" : "llmnr_poison" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 7 , "confidence" : 0.6 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" responder \" , \" value \" : \" 10.0.0.66 \" }, { \" type \" : \" llmnr \" , \" answered_names \" : 6}]" , "state" : "CANDIDATE" , "mitre" : [ "T1557.001" ], "entities_decoded" : [ { "type" : "ip" , "role" : "responder" , "value" : "10.0.0.66" }, { "type" : "llmnr" , "answered_names" : 6 } ] } WHAT TO INVESTIGATE Isolate the responder; confirm it is not a legitimate service. Check which names it answered and who queried. password_spraying sev 7 credential_access T1110.003 DELIVERED → SIEM
10 distinct accounts failed auth One source failing authentication across many distinct accounts — low-and-slow credential attack.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:20+00:00" , "event_type" : "krb5" , "src_ip" : "10.0.0.99" , "dest_ip" : "10.0.0.14" , "krb5" : { "error_code" : "KDC_ERR_PREAUTH_FAILED" , "cname" : "alice" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:password_spraying-5892380474-2982647:r1" , "_source" : { "finding_id" : "password_spraying-5892380474-2982647" , "tenant_id" : "default" , "detector_id" : "password_spraying" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.99 \" }, { \" type \" : \" spray \" , \" distinct_accounts \" : 10}]" , "state" : "FINAL" , "mitre" : [ "T1110.003" ], "sensor_ids" : [], "evidence_refs" : [], "revision" : 1 , "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "NOT_REQUIRED" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-09-16T19:50:33Z" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|password_spraying|credential_access|7|cs1=password_spraying-5892380474-2982647 cs1Label=findingId cs2=T1110.003 cs2Label=mitre cs3=default cs3Label=tenant cat=credential_access src=10.0.0.99 cs4=1 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "password_spraying-5892380474-2982647" , "tenant_id" : "default" , "detector_id" : "password_spraying" , "detector_version" : "1.0" , "category" : "credential_access" , "severity" : 7 , "confidence" : 0.7 , "first_seen" : "2026-09-16T19:50:33Z" , "last_seen" : "2026-09-16T19:50:33Z" , "observed" : false , "emitted_at" : "2026-09-16T19:50:33Z" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.99 \" }, { \" type \" : \" spray \" , \" distinct_accounts \" : 10}]" , "state" : "CANDIDATE" , "mitre" : [ "T1110.003" ], "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.99" }, { "type" : "spray" , "distinct_accounts" : 10 } ] } WHAT TO INVESTIGATE Check the sprayed accounts for any successful logon. Confirm the source is not a misconfigured service.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish These fire only on internal Windows/AD traffic reaching the sensor; a flat network correctly produces nothing. A pattern match is not a confirmed compromise.
Sensor coverage health Suricata reports counters; it does not decide that the counters mean blind spots. Cernity turns drop and app-layer ratios into explicit coverage-degradation leads.
SURICATA BASELINE 2 EVE records 0 alerts → CERNITY → SIEM 2 delivered
coverage_degraded sev 6 coverage fired 2× DELIVERED → SIEM
Suricata is dropping packets at capture (kernel_drops); detections are being missed on this sensor The sensor is losing visibility — dropping packets at capture, or reassembling almost no app-layer flows.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "stats" , "host" : "sensor-a" , "stats" : { "capture" : { "kernel_packets" : 1000000 , "kernel_drops" : 100000 }, "decoder" : { "pkts" : 1000000 }, "app_layer" : { "flow" : { "http" : 1200 , "tls" : 3400 , "dns" : 5000 } } } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:cov-sensor-a-capture_loss:r2" , "_source" : { "finding_id" : "cov-sensor-a-capture_loss" , "tenant_id" : "default" , "detector_id" : "coverage_degraded" , "detector_version" : "1.0" , "category" : "coverage" , "severity" : 6 , "confidence" : 0.8 , "entities" : "[{ \" type \" : \" sensor \" , \" value \" : \" sensor-a \" }, { \" type \" : \" coverage \" , \" value \" : \" capture_loss \" }, { \" type \" : \" metric \" , \" value \" : 0.0909}, { \" type \" : \" why \" , \" value \" : \" Suricata is dropping packets at capture (kernel_drops); detections are being missed on this sensor \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : null } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|coverage_degraded|coverage|6|cs1=cov-sensor-a-capture_loss cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=coverage cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "cov-sensor-a-capture_loss" , "tenant_id" : "default" , "detector_id" : "coverage_degraded" , "detector_version" : "1.0" , "category" : "coverage" , "severity" : 6 , "confidence" : 0.8 , "entities" : "[{ \" type \" : \" sensor \" , \" value \" : \" sensor-a \" }, { \" type \" : \" coverage \" , \" value \" : \" capture_loss \" }, { \" type \" : \" metric \" , \" value \" : 0.0909}, { \" type \" : \" why \" , \" value \" : \" Suricata is dropping packets at capture (kernel_drops); detections are being missed on this sensor \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "sensor" , "value" : "sensor-a" }, { "type" : "coverage" , "value" : "capture_loss" }, { "type" : "metric" , "value" : 0.0909 }, { "type" : "why" , "value" : "Suricata is dropping packets at capture (kernel_drops); detections are being missed on this sensor" } ] } WHAT TO INVESTIGATE Check the sensor’s CPU / ring-buffer sizing. Verify the SPAN/tap delivers both directions.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish A collection-health warning, explicitly separated from a malicious-traffic claim. A missing stats stream is not itself proof of health.
Protocol-integrity anomalies Suricata emits anomaly events into a stream most pipelines ignore. Cernity promotes the security-relevant classes (app-layer, evasion-class stream) and ignores decoder noise.
SURICATA BASELINE 2 EVE records 0 alerts → CERNITY → SIEM 2 delivered
protocol_anomaly sev 5 anomaly fired 2× DELIVERED → SIEM
http.unexpected_data A security-relevant Suricata protocol anomaly — unexpected app-layer data or an evasion-class stream overlap.
SURICATA → EVE Triggering source record · unmodified · 0 alerts raised
{ "timestamp" : "2026-01-01T00:00:00+00:00" , "event_type" : "anomaly" , "src_ip" : "10.0.0.5" , "dest_ip" : "203.0.113.10" , "app_proto" : "http" , "anomaly" : { "type" : "applayer" , "event" : "http.unexpected_data" } } WHAT THE SOC ANALYST SEES · ELASTICSEARCH Stored SIEM document — _index / _id / _source
{ "_index" : "ndr-findings-2026.09.16" , "_id" : "default:anom-8448545772:r2" , "_source" : { "finding_id" : "anom-8448545772" , "tenant_id" : "default" , "detector_id" : "protocol_anomaly" , "detector_version" : "1.0" , "category" : "anomaly" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-01-01T00:00:00+00:00" , "last_seen" : "2026-01-01T00:00:00+00:00" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" anomaly \" , \" value \" : \" http.unexpected_data \" }, { \" type \" : \" app_proto \" , \" value \" : \" http \" }]" , "state" : "FINAL" , "sensor_ids" : [], "evidence_refs" : [], "revision" : 2 , "mitre" : [], "capture_job_ids" : [], "suppression_reason" : "" , "enrichment_state" : "TIMEOUT" , "devo_delivery_state" : "QUEUED" , "@timestamp" : "2026-01-01T00:00:00+00:00" } } SAME FINDING · CEF EVENT (syslog SIEM) CEF:0|Cernity|NDR|1.0|protocol_anomaly|anomaly|5|cs1=anom-8448545772 cs1Label=findingId cs2Label=mitre cs3=default cs3Label=tenant cat=anomaly src=10.0.0.5 dst=203.0.113.10 cs4=2 cs4Label=revision Detector output before the lifecycle (raw candidate) { "finding_id" : "anom-8448545772" , "tenant_id" : "default" , "detector_id" : "protocol_anomaly" , "detector_version" : "1.0" , "category" : "anomaly" , "severity" : 5 , "confidence" : 0.5 , "first_seen" : "2026-01-01T00:00:00+00:00" , "last_seen" : "2026-01-01T00:00:00+00:00" , "entities" : "[{ \" type \" : \" ip \" , \" role \" : \" src \" , \" value \" : \" 10.0.0.5 \" }, { \" type \" : \" ip \" , \" role \" : \" dst \" , \" value \" : \" 203.0.113.10 \" }, { \" type \" : \" anomaly \" , \" value \" : \" http.unexpected_data \" }, { \" type \" : \" app_proto \" , \" value \" : \" http \" }]" , "state" : "CANDIDATE" , "entities_decoded" : [ { "type" : "ip" , "role" : "src" , "value" : "10.0.0.5" }, { "type" : "ip" , "role" : "dst" , "value" : "203.0.113.10" }, { "type" : "anomaly" , "value" : "http.unexpected_data" }, { "type" : "app_proto" , "value" : "http" } ] } WHAT TO INVESTIGATE Pull the flow to see the endpoints and protocol. Determine whether it is a middlebox artifact or deliberate evasion.
The left pane is the exact Suricata EVE that triggered the detector; the right is the finalized finding as it reaches the SIEM — the Elasticsearch _source and the CEF event — produced by the real finding-service lifecycle and findings-forwarder, both taken verbatim from the capture. enrichment_state: TIMEOUT means the finding was delivered now and packet evidence would attach only where a forensics overlay is deployed; it is not a failure or a drop.
What this does not establish Depends on Suricata’s anomaly logging being enabled; classification is by anomaly class, not deep analysis.
METHOD & PROVENANCE How these captures were produced. What was run Each fixture of Suricata EVE was replayed through the real detector, the finding-service lifecycle, and the findings-forwarder (tools/proof-capture/capture.py). The source record on the left is the unmodified EVE that triggered the detector; the SIEM document on the right is what the forwarder emitted (Elasticsearch _id = tenant:finding_id:rN, and the CEF event). Only the plain-language explanations are hand-authored.
What it is not This is an in-process pipeline over synthetic fixtures — not a live Elasticsearch cluster, not a customer incident, and not a claim of precision, recall, calibrated confidence, or production scale. A configured SIEM might derive some of these patterns from raw telemetry; the point is the finalized, explained record Cernity delivers that a bare Suricata alert stream does not.
← Back to the record-by-record field guide