Hi all, I need some help in understanding the meaning of “timestamp” field of flow event types in eve.json output of Suricata. What does this timestamp represent? I noticed that “timestamp” is different from “start” and “end” of the flow. In some cases, the value of timestamps are before the start of flow, in other cases, timestamps are after the start of flow. In some cases, I also observed the timestamp is 1970-01-01T00:00:00.000000+0000 (which i guessed could be because suricata is somehow reading unix timestamp 0).
Any help in understanding this is much appreciated.