{
  "bundle": "distributed-exfil",
  "filter": {
    "src_ip": "10.0.0.15",
    "dest_ip": "198.51.100.50",
    "detector_id": "beacon"
  },
  "summary": {
    "source_records": 305,
    "baseline_records": 305,
    "baseline_all_alerts": 210,
    "matching_flows": 13,
    "matching_alerts": 5,
    "matching_toserver_bytes": 5938272,
    "matching_unique_destinations": 1,
    "median_flow_start_interval": 6.754207491874695,
    "b_all_documents": 4,
    "matching_b_documents": 2,
    "matching_b_unique_ids": 2
  },
  "completion": "inputs_drained",
  "replay": {
    "replay_offset_seconds": 89416108.996723,
    "anchor": "start",
    "recorded_at": "2026-09-14T20:01:48.999709+00:00"
  },
  "provenance": {
    "export_hashes_verified": true,
    "baseline_matches_source_except_ingestion_timestamp": true,
    "source_export_sha256": "2e786f67acb9a76070f60dccbeac80fbf7f2a1eca7910171a79da6333c0e8d1b",
    "baseline_export_sha256": "5f0e6791d45bc6c71817cc9ce2877d860d6bad9f460153ae957d007066aaca85",
    "finding_export_sha256": "49df22d2f087a302ceac0f618785eac5bc488e7a3a5c19bec1653b6e61455bee",
    "selection": "Original exported document bodies; not SIEM UI screenshots or search-result wrappers. Only selected synthetic records are included."
  },
  "suricata": {
    "@timestamp": "2026-09-14T20:02:22.525Z",
    "community_id": "1:HPG68xqnBcVdkLwwIDXaVLrS6TE=",
    "dest_ip": "198.51.100.50",
    "dest_port": 443,
    "event_type": "flow",
    "flow": {
      "age": 0,
      "alerted": false,
      "bytes_toclient": 162,
      "bytes_toserver": 2270,
      "end": "2023-11-14T22:14:14.886256+0000",
      "pkts_toclient": 3,
      "pkts_toserver": 5,
      "reason": "shutdown",
      "start": "2023-11-14T22:14:14.656256+0000",
      "state": "closed"
    },
    "flow_id": 1692699489404373,
    "ip_v": 4,
    "proto": "TCP",
    "src_ip": "10.0.0.15",
    "src_port": 5913,
    "tcp": {
      "ack": true,
      "fin": true,
      "psh": true,
      "state": "last_ack",
      "syn": true,
      "tc_max_regions": 1,
      "tcp_flags": "1b",
      "tcp_flags_tc": "13",
      "tcp_flags_ts": "1b",
      "ts_max_regions": 1
    },
    "timestamp": "2023-11-14T22:13:20.000000+0000"
  },
  "cernity": {
    "@timestamp": "2026-09-14T20:03:14.508262Z",
    "capture_job_ids": [],
    "category": "c2",
    "confidence": 0.907,
    "detector_id": "beacon",
    "detector_version": "1.0",
    "devo_delivery_state": "QUEUED",
    "emitted_at": "2026-09-14T20:03:42Z",
    "enrichment_state": "NOT_REQUIRED",
    "entities": "[{\"type\": \"ip\", \"role\": \"src\", \"value\": \"10.0.0.15\"}, {\"type\": \"ip\", \"role\": \"dst\", \"value\": \"198.51.100.50\"}, {\"type\": \"interval_s\", \"value\": 6.7}, {\"type\": \"jitter_s\", \"value\": 2.2}, {\"type\": \"connections\", \"value\": 13}]",
    "evidence_refs": [],
    "finding_id": "beacon-2213739182-2982360",
    "first_seen": "2026-09-14T20:01:53.996723Z",
    "last_seen": "2026-09-14T20:03:14.508262Z",
    "mitre": [
      "T1071"
    ],
    "observed": true,
    "revision": 1,
    "sensor_ids": [],
    "severity": 8,
    "state": "FINAL",
    "suppression_reason": "",
    "tenant_id": "default"
  },
  "additional_alert": {
    "@timestamp": "2026-09-14T20:02:22.525Z",
    "alert": {
      "action": "allowed",
      "category": "Generic Protocol Command Decode",
      "gid": 1,
      "rev": 3,
      "severity": 3,
      "signature": "SURICATA STREAM ESTABLISHED packet out of window",
      "signature_id": 2210020
    },
    "community_id": "1:oYkPOf4qtzZjgLbnnGvoRSHWEVU=",
    "dest_ip": "198.51.100.50",
    "dest_port": 443,
    "direction": "to_server",
    "event_type": "alert",
    "flow": {
      "bytes_toclient": 108,
      "bytes_toserver": 10706,
      "dest_ip": "198.51.100.50",
      "dest_port": 443,
      "pkts_toclient": 2,
      "pkts_toserver": 9,
      "src_ip": "10.0.0.15",
      "src_port": 39097,
      "start": "2023-11-14T22:13:25.000000+0000"
    },
    "flow_id": 1407377250048501,
    "ip_v": 4,
    "metadata": {},
    "pcap_cnt": 977,
    "pkt_src": "wire/pcap",
    "proto": "TCP",
    "src_ip": "10.0.0.15",
    "src_port": 39097,
    "timestamp": "2023-11-14T22:13:25.071460+0000"
  },
  "cernity_matching_records": [
    {
      "@timestamp": "2026-09-14T20:03:14.508262Z",
      "capture_job_ids": [],
      "category": "c2",
      "confidence": 0.907,
      "detector_id": "beacon",
      "detector_version": "1.0",
      "devo_delivery_state": "QUEUED",
      "emitted_at": "2026-09-14T20:03:42Z",
      "enrichment_state": "NOT_REQUIRED",
      "entities": "[{\"type\": \"ip\", \"role\": \"src\", \"value\": \"10.0.0.15\"}, {\"type\": \"ip\", \"role\": \"dst\", \"value\": \"198.51.100.50\"}, {\"type\": \"interval_s\", \"value\": 6.7}, {\"type\": \"jitter_s\", \"value\": 2.2}, {\"type\": \"connections\", \"value\": 13}]",
      "evidence_refs": [],
      "finding_id": "beacon-2213739182-2982360",
      "first_seen": "2026-09-14T20:01:53.996723Z",
      "last_seen": "2026-09-14T20:03:14.508262Z",
      "mitre": [
        "T1071"
      ],
      "observed": true,
      "revision": 1,
      "sensor_ids": [],
      "severity": 8,
      "state": "FINAL",
      "suppression_reason": "",
      "tenant_id": "default"
    },
    {
      "@timestamp": "2026-09-14T20:03:03.511413Z",
      "capture_job_ids": [],
      "category": "c2",
      "confidence": 0.94,
      "detector_id": "beacon",
      "detector_version": "1.0",
      "devo_delivery_state": "QUEUED",
      "emitted_at": "2026-09-14T20:03:12Z",
      "enrichment_state": "NOT_REQUIRED",
      "entities": "[{\"type\": \"ip\", \"role\": \"src\", \"value\": \"10.0.0.15\"}, {\"type\": \"ip\", \"role\": \"dst\", \"value\": \"198.51.100.50\"}, {\"type\": \"interval_s\", \"value\": 6.3}, {\"type\": \"jitter_s\", \"value\": 1.9}, {\"type\": \"connections\", \"value\": 12}]",
      "evidence_refs": [],
      "finding_id": "beacon-1527702485-2982360",
      "first_seen": "2026-09-14T20:01:53.996723Z",
      "last_seen": "2026-09-14T20:03:03.511413Z",
      "mitre": [
        "T1071"
      ],
      "observed": true,
      "revision": 1,
      "sensor_ids": [],
      "severity": 8,
      "state": "FINAL",
      "suppression_reason": "",
      "tenant_id": "default"
    }
  ],
  "suricata_excerpt": {
    "event_type": "flow",
    "timestamp": "2023-11-14T22:13:20.000000+0000",
    "flow_id": 1692699489404373,
    "community_id": "1:HPG68xqnBcVdkLwwIDXaVLrS6TE=",
    "src_ip": "10.0.0.15",
    "src_port": 5913,
    "dest_ip": "198.51.100.50",
    "dest_port": 443,
    "flow": {
      "age": 0,
      "alerted": false,
      "bytes_toclient": 162,
      "bytes_toserver": 2270,
      "end": "2023-11-14T22:14:14.886256+0000",
      "pkts_toclient": 3,
      "pkts_toserver": 5,
      "reason": "shutdown",
      "start": "2023-11-14T22:14:14.656256+0000",
      "state": "closed"
    }
  },
  "cernity_excerpt": {
    "category": "c2",
    "confidence": 0.907,
    "detector_id": "beacon",
    "enrichment_state": "NOT_REQUIRED",
    "entities": [
      {
        "type": "ip",
        "role": "src",
        "value": "10.0.0.15"
      },
      {
        "type": "ip",
        "role": "dst",
        "value": "198.51.100.50"
      },
      {
        "type": "interval_s",
        "value": 6.7
      },
      {
        "type": "jitter_s",
        "value": 2.2
      },
      {
        "type": "connections",
        "value": 13
      }
    ],
    "evidence_refs": [],
    "finding_id": "beacon-2213739182-2982360",
    "first_seen": "2026-09-14T20:01:53.996723Z",
    "last_seen": "2026-09-14T20:03:14.508262Z",
    "mitre": [
      "T1071"
    ],
    "revision": 1,
    "severity": 8,
    "state": "FINAL"
  }
}