alert-with-dnp3.json

{
  "dnp3": {
    "response": {
      "iin": {
        "indicators": []
      },
      "application": {
        "complete": true,
        "objects": [
          {
            "items": [
              {
                "timestamp": 0,
                "value": 1,
                "reserved": 0,
                "reference_err": 0,
                "prefix": 0,
                "index": 0,
                "online": 1,
                "restart": 0,
                "comm_lost": 0,
                "remote_forced": 0,
                "local_forced": 0,
                "over_range": 0
              }
            ],
            "group": 32,
            "variation": 7,
            "qualifier": 40,
            "prefix_code": 2,
            "range_code": 8,
            "start": 0,
            "stop": 0,
            "count": 1
          }
        ],
        "function_code": 130,
        "control": {
          "sequence": 14,
          "uns": true,
          "con": true,
          "fin": true,
          "fir": true
        }
      },
      "dst": 1,
      "src": 10,
      "control": {
        "function_code": 4,
        "fcv": false,
        "fcb": false,
        "pri": true,
        "dir": false
      },
      "type": "unsolicited_response"
    }
  },
  "alert": {
    "tx_id": 31,
    "severity": 3,
    "category": "",
    "signature": "DNP3 Content match, any direction",
    "rev": 1,
    "signature_id": 3,
    "gid": 1,
    "action": "allowed"
  },
  "proto": "TCP",
  "timestamp": "2015-07-14T11:46:22.022639-0600",
  "flow_id": 56545392,
  "pcap_cnt": 121,
  "event_type": "alert",
  "src_ip": "127.0.0.1",
  "src_port": 20000,
  "dest_ip": "127.0.0.1",
  "dest_port": 59602
}