Using jq for Suricata Log Parsing

Suricata is a high-performance Network Threat Detection, IDS, IPS, and Network Security Monitoring engine. Open source and owned by a community-run, non-profit foundation, the Open Information Security Foundation (OISF). Suricata is developed by OISF, its supporting vendors, and the community.

Corey Thomas is OISF's QA automation Engineer. He's always finding ways to consistently reproduce problems and performance changes. He's helped build and automate OISF’s hardware QA lab and integrate with Github PRs. He has been an Open Source contributor and IT professional for over a dozen years, making the world a safer place, one bug at a time.

Forum announcement:

Presentation Slides:

Cheat sheet:

Suricata-verify test with multi eve files: