Blog
-
How Verdix turns one Suricata alert into a verdict by correlating eve.json records and enrichment
A Suricata alert is one event in eve.json. Here is how Verdix follows the alert's flow_id to the surrounding EVE records, adds enrichment, and hands that evidence to a local model, and where that correlation stops.
-
Source and Destination: Who is the Attacker?
A Suricata alert gives you source and destination, not attacker and victim. On the alerts that matter most, the two invert. Here is how Verdix assesses attacker and victim, and when it marks the call ambiguous.