That the exact same thing I have. the ‘host’ key shows up in all logs. However, there is no ‘host’ key in my stats. Weird and it’s probably something I’m doing:
sensor-name: quadrant-soc-att-fiber
{“timestamp”:“2020-08-05T14:20:01.387846-0400”,“flow_id”:46634626050822,“in_iface”:“eth0”,“event_type”:“alert”,“src_ip”:“12.159.2.10”,"
dest_ip":“12.145.241.1”,“proto”:“ICMP”,“icmp_type”:8,“icmp_code”:0,“alert”:{“action”:“allowed”,“gid”:1,“signature_id”:20000004,“rev”:1,
“signature”:“QUADRANT Ping Packet [ICMP]”,“category”:“Not Suspicious Traffic”,“severity”:3},“flow”:{“pkts_toserver”:1,“pkts_toclient”:0
,“bytes_toserver”:98,“bytes_toclient”:0,“start”:“2020-08-05T14:20:01.387846-0400”},“payload”:“UfgqXwAAAABZ6gUAAAAAAE9GVFdJTkstUElOR9raU
09GVFdJTkstUElOR9raU09GVFdJTkstUEk=”,“stream”:0,“packet”:“VDloDw7EADAYyy2NCABFAABU3y9AAEABTz4MnwIKDJHxAQgA/qwMJAABUfgqXwAAAABZ6gUAAAAA
AE9GVFdJTkstUElOR9raU09GVFdJTkstUElOR9raU09GVFdJTkstUEk=”,“packet_info”:{“linktype”:1},“host”:“quadrant-soc-att-fiber”}
tail -n 1000 stats.log | grep ‘host’
Shows no results.
I’ll keep poking.