{
  "bundle": "distributed-exfil",
  "filter": {
    "src_ip": "10.0.0.15",
    "dest_ip": "203.0.113.200",
    "detector_id": "low_slow_exfil"
  },
  "summary": {
    "source_records": 305,
    "baseline_records": 305,
    "baseline_all_alerts": 210,
    "matching_flows": 11,
    "matching_alerts": 44,
    "matching_toserver_bytes": 5933840,
    "matching_unique_destinations": 1,
    "median_flow_start_interval": 6.298277974128723,
    "b_all_documents": 4,
    "matching_b_documents": 1,
    "matching_b_unique_ids": 1
  },
  "completion": "inputs_drained",
  "replay": {
    "replay_offset_seconds": 89416108.996723,
    "anchor": "start",
    "recorded_at": "2026-09-14T20:01:48.999709+00:00"
  },
  "provenance": {
    "export_hashes_verified": true,
    "baseline_matches_source_except_ingestion_timestamp": true,
    "source_export_sha256": "2e786f67acb9a76070f60dccbeac80fbf7f2a1eca7910171a79da6333c0e8d1b",
    "baseline_export_sha256": "5f0e6791d45bc6c71817cc9ce2877d860d6bad9f460153ae957d007066aaca85",
    "finding_export_sha256": "49df22d2f087a302ceac0f618785eac5bc488e7a3a5c19bec1653b6e61455bee",
    "selection": "Original exported document bodies; not SIEM UI screenshots or search-result wrappers. Only selected synthetic records are included."
  },
  "suricata": {
    "@timestamp": "2026-09-14T20:02:22.525Z",
    "community_id": "1:TYOE9eXmSyQ1HYI6RvZKbe0ZS9U=",
    "dest_ip": "203.0.113.200",
    "dest_port": 443,
    "event_type": "flow",
    "flow": {
      "age": 2,
      "alerted": true,
      "bytes_toclient": 2538,
      "bytes_toserver": 539440,
      "end": "2023-11-14T22:13:22.470184+0000",
      "pkts_toclient": 47,
      "pkts_toserver": 360,
      "reason": "shutdown",
      "start": "2023-11-14T22:13:20.000000+0000",
      "state": "established"
    },
    "flow_id": 3915403230,
    "ip_v": 4,
    "metadata": {},
    "proto": "TCP",
    "src_ip": "10.0.0.15",
    "src_port": 32733,
    "tcp": {
      "ack": true,
      "fin": true,
      "psh": true,
      "state": "established",
      "syn": true,
      "tc_max_regions": 1,
      "tcp_flags": "1b",
      "tcp_flags_tc": "13",
      "tcp_flags_ts": "1b",
      "ts_max_regions": 1
    },
    "timestamp": "2023-11-14T22:13:20.000000+0000"
  },
  "cernity": {
    "@timestamp": "2026-09-14T20:02:56.221471Z",
    "capture_job_ids": [],
    "category": "exfil",
    "confidence": 0.22,
    "detector_id": "low_slow_exfil",
    "detector_version": "1.0",
    "devo_delivery_state": "QUEUED",
    "emitted_at": "2026-09-14T20:03:12Z",
    "enrichment_state": "NOT_REQUIRED",
    "entities": "[{\"type\": \"ip\", \"role\": \"src\", \"value\": \"10.0.0.15\"}, {\"type\": \"ip\", \"role\": \"dst\", \"value\": \"203.0.113.200\"}, {\"type\": \"bytes\", \"value\": 5933840}, {\"type\": \"connections\", \"value\": 11}]",
    "evidence_refs": [],
    "finding_id": "low_slow_exfil-8318109249-2982360",
    "first_seen": "2026-09-14T20:01:48.996723Z",
    "last_seen": "2026-09-14T20:02:56.221471Z",
    "mitre": [
      "TA0010"
    ],
    "observed": true,
    "revision": 1,
    "sensor_ids": [],
    "severity": 6,
    "state": "FINAL",
    "suppression_reason": "",
    "tenant_id": "default"
  },
  "additional_alert": {
    "@timestamp": "2026-09-14T20:02:22.524Z",
    "alert": {
      "action": "allowed",
      "category": "Generic Protocol Command Decode",
      "gid": 1,
      "rev": 3,
      "severity": 3,
      "signature": "SURICATA STREAM ESTABLISHED packet out of window",
      "signature_id": 2210020
    },
    "community_id": "1:TYOE9eXmSyQ1HYI6RvZKbe0ZS9U=",
    "dest_ip": "203.0.113.200",
    "dest_port": 443,
    "direction": "to_server",
    "event_type": "alert",
    "flow": {
      "bytes_toclient": 108,
      "bytes_toserver": 10706,
      "dest_ip": "203.0.113.200",
      "dest_port": 443,
      "pkts_toclient": 2,
      "pkts_toserver": 9,
      "src_ip": "10.0.0.15",
      "src_port": 32733,
      "start": "2023-11-14T22:13:20.000000+0000"
    },
    "flow_id": 3915403230,
    "ip_v": 4,
    "metadata": {},
    "pcap_cnt": 24,
    "pkt_src": "wire/pcap",
    "proto": "TCP",
    "src_ip": "10.0.0.15",
    "src_port": 32733,
    "timestamp": "2023-11-14T22:13:20.051012+0000"
  },
  "cernity_matching_records": [
    {
      "@timestamp": "2026-09-14T20:02:56.221471Z",
      "capture_job_ids": [],
      "category": "exfil",
      "confidence": 0.22,
      "detector_id": "low_slow_exfil",
      "detector_version": "1.0",
      "devo_delivery_state": "QUEUED",
      "emitted_at": "2026-09-14T20:03:12Z",
      "enrichment_state": "NOT_REQUIRED",
      "entities": "[{\"type\": \"ip\", \"role\": \"src\", \"value\": \"10.0.0.15\"}, {\"type\": \"ip\", \"role\": \"dst\", \"value\": \"203.0.113.200\"}, {\"type\": \"bytes\", \"value\": 5933840}, {\"type\": \"connections\", \"value\": 11}]",
      "evidence_refs": [],
      "finding_id": "low_slow_exfil-8318109249-2982360",
      "first_seen": "2026-09-14T20:01:48.996723Z",
      "last_seen": "2026-09-14T20:02:56.221471Z",
      "mitre": [
        "TA0010"
      ],
      "observed": true,
      "revision": 1,
      "sensor_ids": [],
      "severity": 6,
      "state": "FINAL",
      "suppression_reason": "",
      "tenant_id": "default"
    }
  ],
  "suricata_excerpt": {
    "event_type": "flow",
    "timestamp": "2023-11-14T22:13:20.000000+0000",
    "flow_id": 3915403230,
    "community_id": "1:TYOE9eXmSyQ1HYI6RvZKbe0ZS9U=",
    "src_ip": "10.0.0.15",
    "src_port": 32733,
    "dest_ip": "203.0.113.200",
    "dest_port": 443,
    "flow": {
      "age": 2,
      "alerted": true,
      "bytes_toclient": 2538,
      "bytes_toserver": 539440,
      "end": "2023-11-14T22:13:22.470184+0000",
      "pkts_toclient": 47,
      "pkts_toserver": 360,
      "reason": "shutdown",
      "start": "2023-11-14T22:13:20.000000+0000",
      "state": "established"
    }
  },
  "cernity_excerpt": {
    "category": "exfil",
    "confidence": 0.22,
    "detector_id": "low_slow_exfil",
    "enrichment_state": "NOT_REQUIRED",
    "entities": [
      {
        "type": "ip",
        "role": "src",
        "value": "10.0.0.15"
      },
      {
        "type": "ip",
        "role": "dst",
        "value": "203.0.113.200"
      },
      {
        "type": "bytes",
        "value": 5933840
      },
      {
        "type": "connections",
        "value": 11
      }
    ],
    "evidence_refs": [],
    "finding_id": "low_slow_exfil-8318109249-2982360",
    "first_seen": "2026-09-14T20:01:48.996723Z",
    "last_seen": "2026-09-14T20:02:56.221471Z",
    "mitre": [
      "TA0010"
    ],
    "revision": 1,
    "severity": 6,
    "state": "FINAL"
  }
}