---

sudo jq 'select(.event_type=="alert") | {timestamp, src_ip, dest_ip, proto, signature: .alert.signature, sid: .alert.signature_id, category: .alert.category, severity: .alert.severity}' /var/log/suricata/eve.json