Skip to content

Using Sguil In Investigating Network Data


The primary duty of a cybersecurity analyst is the verification of security alerts. Depending on the organization, the tools used to do this will vary. For example, a ticketing system may be used to manage task assignments and documentation. In Security Onion, the first place that a cybersecurity analyst will go to verify alerts is Sguil. In this article, I want to look at some of the ways of investigating network data in cybersecurity. Follow me as we are going to look at that in this article. 


Sguil automatically correlates similar alerts into a single line and provides a way to view correlated events represented by that line. In order to get a sense of what has been happening in the network, it may be useful to sort on the CNT column to display the alerts with the highest frequency.
Right-clicking the CNT value and selecting View Correlated Events opens a tab that displays all events that are related by Sguil. This can help the cybersecurity analyst understand the time frame during which the correlated events were received by Sguil. Note that each event receives a unique event ID. Only the first event ID in the series of correlated events is displayed in the RealTime Events tab. The figure shows Sguil alerts sorted on CNT with the View Correlated Events menu open.

Sguil Alerts Sorted on CNT

Sguil Queries

Queries can be constructed in Sguil using the Query Builder. It simplifies constructing queries to a certain degree, but the cybersecurity analyst must know the field names and some issues with field values. For example, Sguil stores IP addresses in an integer representation. In order to query an IP address in dotted-decimal notation, the IP address value must be placed within the INET_ATON() function. Query Builder is opened from the Sguil Query menu. Select Query Event Table to search active events.

The table shows the names of some of the event table fields that can be queried directly. Selecting Show DataBase Tables from the Query menu displays a reference to the field names and types for each of the tables that can be queried. When conducting event table searches, use the pattern event.fieldName = value.


Field Name Type Description
sid int the unique ID of the sensor
cid int the sensor’s unique event number
signature varchar the human-readable name of the event (e.g. “WEB-IIS view source via translate header”)
timestamp datetime the date and time the event occurred on the sensor
status int the Sguil classification assigned to this event. Unclassified events are priority 0.
src_ip int the source IP for the event. Use the INET_ATON() function to covert the address to the database’s integer representation.
dst_ip int the destination IP for the event
src_port int the source port of the packet that triggered the event
dst_port int the destination port of the packet that triggered the event
ip_proto ing IP protocol type of the packet. (6 = TCP, 17 = UDP, 1 = ICMP, others are possible)
The figure shows a simple timestamp and IP address query made in the Query Builder window. Note the use of the INET_ATON() function to simplify entering an IP address.
The figure shows the Sguil Query Builder interface which aids in constructing proper Sguil query syntax.
In the example below, the cybersecurity analyst is investigating a source port 40754 that is associated with an Emerging Threats alert. Towards the end of the query, the WHERE event.src_port = ‘40754’ portion was created by the user in Query Builder. The remainder of the query is supplied automatically by Sguil and concerns how the data that is associated with the events is to be retrieved, displayed, and presented.

Pivoting from Sguil

Sguil provides the ability for the cybersecurity analyst to pivot to other information sources and tools. Log files are available in Elasticsearch. Relevant packet captures can be displayed in Wireshark.
Transcripts of TCP sessions and Zeek (Bro) detection information are also available. The menu shown in the figure was opened by right-clicking on an Alert ID. Selecting from this menu will open information about the alert in other tools, which provides rich, contextualized information to the cybersecurity analyst.

Pivoting from Sguil

The figure shows the Sguil window. The menu that results from right-clicking an alert I.D. is shown. The choices in the menu are Event History, Transcript, Transcript (force new), Wireshark, Wireshark (force new), NetworkMiner, NetworkMiner (force new), Bro, Bro (force new).
Additionally, Sguil can provide pivots to Passive Real-time Asset Detection System (PRADS) and Security Analyst Network Connection Profiler (SANCP) information. These tools are accessed by right-clicking on an IP address for an event and selecting the Quick Query or Advanced Query menus.
PRADS gathers network profiling data, including information about the behaviour of assets on the network. PRADS is an event source, like Snort and OSSEC. It can also be queried through Sguil when an alert indicates that an internal host may have been compromised.
Executing a PRADS query out of Sguil can provide information about the services, applications, and payloads that may be relevant to the alert. In addition, PRADS detects when new assets appear on the network.
Note: The Sguil interface refers to PADS instead of PRADS. PADS was the predecessor to PRADS. PRADS is the tool that is actually used in Security Onion. PRADS is also used to populate SANCP tables. In Security Onion, the functionalities of SANCP have been replaced by PRADS, however, the term SANCP is still used in the Sguil interface. PRADS collects the data, and a SANCP agent records the data in a SANCP data table.


The SANCP functionalities concern collecting and recording statistical information about network traffic and behaviour. SANCP provides a means of verifying that network connections are valid. This is done through the application of rules that indicate which traffic should be recorded and the information with which the traffic should be tagged.

Event Handling in Sguil

Finally, Sguil is not only a console that facilitates the investigation of alerts. It is also a tool for addressing or classifying alerts. Three tasks can be completed in Sguil to manage alerts. First, alerts that have been found to be false positives can be expired.

This can be done by using the right-clicking in the ST column for the event and using the menu or by pressing the F8 key. An expired event disappears from the queue. Second, if the cybersecurity analyst is uncertain how to handle an event, it can be escalated by pressing the F9 key.

The alert will be moved to the Sguil Escalated Events tab. Finally, an event can be categorized. Categorization is for events that have been identified as true positives.


Sguil includes seven pre-built categories that can be assigned by using a menu, which is shown in the figure, or by pressing the corresponding function key. For example, an event would be categorized as Cat I by pressing the F1 key. In addition, criteria can be created that will automatically categorize an event.

Categorized events are assumed to have been handled by the cybersecurity analyst. When an event is categorized, it is removed from the list of RealTime Events. The event remains in the database, however, and it can be accessed by queries that are issued by category.


This course covers Sguil at a basic level. Numerous resources exist on the internet for learning more.


Event Handling in Sguil

The figure shows how alert events can be updated with comments and placed into different category levels by right+clicking on the alert status in the ST column, choosing Update Event Status, and then choosing a Category level with or without comment.

Working in ELK

Logstash and Beats are used for data ingestion in the Elastic Stack. They provide access to large numbers of log file entries. Because the number of logs that can be displayed is so large, Kibana, which is the visual interface into the logs, is configured to show the last 24 hours by default. You can adjust the time range to view broader or older ranges of data.
The figure shows how to set an absolute time range in Kibana by clicking Last 24 Hours in the upper rght corner of the interface and choosing the Absolute tab.
In order to see log file records for a different period of time, click the Last 24 hours tab in the upper right corner of Kibana. From there, set the Time Range by selecting the Quick tab for predefined time ranges. You can also enter the dates and times manually using the Absolute tab.
The figure shows an Absolute time range from May 17th to May 18th, 2020. Logs are ingested into Elasticsearch into separate indices or databases based on a configured range of time.
The best way to monitor your data in Elasticsearch is to build customized visual dashboards that track the data that you are interested in using. A variety of visual charts including bar graphs, pie charts, count metrics, heat maps, Geo maps, top number lists are available. In Kibana, visualizations and charts can be searched and filtered with specific metrics and buckets of data.

Queries in ELK

Elasticsearch is built on Apache Lucene, an open-source search engine software library that features full-text indexing and searching capabilities. Elasticsearch ingests data into documents called indices and those documents are mapped to various datatypes using index patterns. The index patterns create a data structure of JSON-formatted fields and values. The datatypes in the fields can be in the following formats:

  • Core Datatypes: Text (Strings), Numeric, Date, Boolean, Binary, and Range
  • Complex Datatypes: Object (JSON), Nested (arrays of JSON objects)
  • Geo Datatypes: Geo-point (latitude/longitude), Geo-shape (polygons)
  • Specialized Datatypes: IP addresses, Token count, Histogram, etc.)

Using Lucene software libraries, Elasticsearch has its own query language based on JSON called Query DSL (Domain Specific Language). Query DSL features leaf queries, compound queries, and expensive queries.

Leaf queries look for a specific value in a specific field, such as the match, term, or range queries. Compound queries enclose other leaf or compound queries and are used to combine multiple queries in a logical fashion. Expensive queries execute slowly and include fuzzy matching, regex matching, and wildcard matching.


Query Language
Along with JSON, Elasticsearch queries make use of the following elements: Boolean operators, Fields, Ranges, Wildcards, Regex, Fuzzy search, Text search.
  • Boolean Operators – AND, OR, and NOT operators:
    • “php” OR “zip” OR “exe” OR “jar” OR “run”
    • “RST” AND “ACK”
  • Fields – In colon-separated key: value pairs you specify the key field, a colon, a space and the value:
    • dst.ip: “”
    • dst.port: 80
  • Ranges – You can search for fields within a specific range using square brackets (inclusive) or curly braces (exclusive) range:
    • host:[1 TO 255] — Will return events with age between 1 and 255
    • TTL:{100 TO 400} — Will return events with prices between 101 and 399
    • name: [Admin TO User] — Will return names between and including Admin and User
  • Wildcards – The * character is for multiple character wildcards and the ? character for single-character wildcards:
    • P?ssw?rd — Will match Password, and P@ssw0rd
    • Pas* — Will match Pass, Passwd, and Password
  • Regex – These are placed between forward slashes (/):
    • /d[ao]n/ — Will match both dan and don
    • /<.+>/ — Will match text that resembles an HTML tag
  • Fuzzy Search – Fuzzy searching uses the Damerau-Levenshtein Distance to match terms that are similar in spelling. This is great when your data set has misspelt words. Use the tilde (~) to find similar terms:
    • index.php~ – This may return results like “index.html,” “home.php”, and “info.php.”
    • Use the tilde (~) along with a number to specify how big the distance between words can be:
    • term~2 – This will match, among other things: “team,” “terms,” “trem,” and “torn”
  • Text search – Type in the term or value you want to find. This can be a field, or a string within a field, etc.


Query Execution
Elasticsearch was designed to interface with users using web-based clients that follow the HTTP REST framework. Queries can be executed using the following methods:
  • URI – Elasticsearch can execute queries using URI searches:
    • http://localhost:9200/_search?
  • cURL – Elasticsearch can execute queries using cURL from the command line:
    • curl “localhost:9200/_search?”
  • JSON – Elasticsearch can execute queries with a request body search using a JSON document beginning with a query element, and a query formatted using the Query Domain Specific Language.
  • Dev Tools – Elasticsearch can execute queries using the Dev Tools console in Kibana and a query formatted using the Query Domain Specific Language.

Note: Advanced Elasticsearch queries are beyond the scope of this course. In the labs, you will be provided with complex query statements, if necessary.

Investigating Process or API Calls

Applications interact with an operating system (OS) through system calls to the OS application programming interface (API), as shown in the figure. These system calls allow access to many aspects of system operation such as:

  • Software process control
  • File management
  • Device management
  • Information management
  • Communication

Malware can also make system calls. If the malware can fool an OS kernel into allowing it to make system calls, many exploits are possible.

HIDS software tracks the operation of a host OS. OSSEC rules detect changes in host-based parameters like the execution of software processes, changes in user privileges, and registry modifications, among many others. OSSEC rules will trigger an alert in Sguil. Pivoting to Kibana on the host IP address allows you to choose the type of alert based on the program that created it. Filtering for OSSEC indices results in a view of the OSSEC events that occurred on the host, including indicators that malware may have interacted with the OS kernel.


The figure shows how a user can make a remote system call, using an application, to access a remote operating system’s API to access information regarding the computer’s files, processes, network status and configuration, I/O, and devices.

Action Point
I know you might agree with some of the points that I have raised in this article. You might not agree with some of the issues raised. Let me know your views about the topic discussed. We will appreciate it if you can drop your comment. Thanks in anticipation.

Fact Check Policy

CRMNIGERIA is committed to fact-checking in a fair, transparent and non-partisan manner. Therefore, if you’ve found an error in any of our reports, be it factual, editorial, or an outdated post, please contact us to tell us about it.

Action Point
PS: If you would like to have an online course on any of the courses that you found on this blog, I will be glad to do that on individual and corporate level, I will be very glad to do that I have trained several individuals and groups and they are doing well in their various fields of endeavour. Some of those that I have trained includes staffs of Dangote Refinery, FCMB, Zenith Bank, New Horizons Nigeria among others. Please come on Whatsapp and let’s talk about your training. You can reach me on Whatsapp HERE. Please note that I will be using Microsoft Team to facilitate the training. 

I know you might agree with some of the points that I have raised in this article. You might not agree with some of the issues raised. Let me know your views about the topic discussed. We will appreciate it if you can drop your comment. Thanks in anticipation.


Fact Check Policy

CRMNAIJA is committed to fact-checking in a fair, transparent and non-partisan manner. Therefore, if you’ve found an error in any of our reports, be it factual, editorial, or an outdated post, please contact us to tell us about it.


Fact Check Policy

Leave a Reply

Your email address will not be published. Required fields are marked *

CommentLuv badge