{{event._source.event_type | uppercase}}:  {{alertGroup.count}} [ {{service.name}} | ]
Timestamp {{event._source.timestamp}}
Sensor
Protocol {{event._source.proto}}
Source :{{event._source.src_port}}
IP Report
Destination :{{event._source.dest_port}}
IP Report
In Interface {{event._source.in_iface}}
Flow ID {{event._source.flow_id}}
Signature {{event._source.alert.signature}}
Category {{event._source.alert.category}}
Signature ID {{event._source.alert.gid}}: :{{event._source.alert.rev}}
Severity {{event._source.alert.severity}}
Transaction ID {{event._source.dns.id}}
Type {{event._source.dns.type | lowercase | titlecase}}
Request {{event._source.dns.rrtype}} {{event._source.dns.rrname}}
Answer {{event._source.dns.rdata}}
Answers
{{answer.rrtype}} {{answer.rrname}} {{answer.rdata}}
Authorities
{{answer.rrtype}} {{answer.rrname}} {{answer.rdata}}
{{item.key | eveboxGenericPrettyPrinter}}

Rule

History
  • {{action.timestamp | eveboxFormatTimestamp}} - Escalated by {{action.username}}
    {{action.timestamp | eveboxFormatTimestamp}} - De-escalated by {{action.username}}
    {{action.timestamp | eveboxFormatTimestamp}} - Archived by {{action.username}}
    {{action.timestamp | eveboxFormatTimestamp}} - Comment by {{action.username}} 
    {{action.comment}}
    {{action.timestamp | eveboxFormatTimestamp}} - <{{action.username}}> : {{action.action}}


DNS
Request
{{query.rrtype}} {{query.rrname}}
Type RRname Rdata
{{answer.rrtype}} {{answer.rrname}} {{answer.rdata}}

HTTP
{{item.key | eveboxGenericPrettyPrinter}}:

HTTP Request Body 
{{event._source.http.http_request_body | eveboxBase64Decode | printable}}
{{event._source.http.http_request_body | eveboxBase64Decode | hex}}

HTTP Response Body 
{{event._source.http.http_response_body | eveboxBase64Decode | printable}}
{{event._source.http.http_response_body | eveboxBase64Decode | hex}}

GeoIP
{{item.key | eveboxGenericPrettyPrinter}}:

TLS
{{item.key | eveboxGenericPrettyPrinter}}:

Payload 
{{event._source.payload | eveboxBase64Decode | printable}}
{{event._source.payload | eveboxBase64Decode | hex}}

Packet 
{{event._source.packet | eveboxBase64Decode | printable}}
{{event._source.packet| eveboxBase64Decode | hex}}

JSON