Suricata Cheat Sheet Select and show HTTP flows jq -c 'select(.flow and .app_proto == "http")' eve.json Display alerts only 只显示告警 jq -c 'select(.alert)' eve.json Select DNS log records with TTL values between 0 and 100 选择TTL 值介于 0 和 100 之间的 DNS 日志记录 jq 'se...