The Suricata Matano managed log source lets you ingest your Suricata IDS/IPS/NSM logs. It parses logs that are in the Suricata Eve JSON format.
Use the managed log source by specifying the
managed.type property in your
Then create tables for each of the Suricata logs you want to ingest. For example, if you want to ingest Suricata Eve logs, create table files like so:
For a complete reference on configuring log sources, including extending the table schema, see Log source configuration.
The Suricata managed log source supports the following tables:
For a log source named
suricata, a file under the path
suricata/afe3c55a-8b05-4ac7-be76-b6fda08af95d/alerts.log will be routed to the
S3 Path scheme to table:
*(all) -> eve
Suricata data is normalized to ECS fields. You can view the complete mappings to see the full schemas.