Add support for Suricata nDPI plugin fields in Arkime

Author: MalllksCreated Jun 18, 2026Updated Jun 19, 2026

Labelsenhancementcapture

Hi everyone, We have successfully integrated nDPI as a plugin into Suricata, which now generates alerts containing a custom nested ndpi object inside the JSON output (eve.json). We want to parse these new custom fields into Arkime so they can be indexed, searched, and displayed in the UI.

Could you please guide us on the best way to achieve this? What is the recommended workflow for adding Arkime support for such nested JSON objects coming from Suricata? Is it possible via configuration, or does it require modifying the suricata.c plugin code?

Elasticsearch version: 8.11.4 Arkime version: 6.5.0-1 OS name and version: NAME="Ubuntu" VERSION="22.04.5 LTS (Jammy Jellyfish)" How was Arkime built/installed: (rpm, deb, easybutton, ...) deb Provide logs, stack traces and steps to reproduce: We plan to use the following configuration in config.ini:

ini

[custom-fields]
ndpi.protocol=kind:termfield;count:true;friendly:nDPI Protocol;db:ndpi.proto;help:nDPI Layer 7 Protocol
ndpi.risk=kind:termfield;count:true;friendly:nDPI Risk;db:ndpi.risk;help:nDPI Risk Category

Here is a trimmed example of our Suricata alert log containing the nested ndpi object:

json

{
  "timestamp": "2026-06-17T13:18:40.864490+0500",
  "event_type": "alert",
  "src_ip": "10.10.12.13",
  "src_port": 63438,
  "dest_ip": "10.10.12.16",
  "dest_port": 22,
  "proto": "TCP",
  "alert": {
    "action": "allowed",
    "signature_id": 50000106,
    "signature": "SSH"
  },
  "ndpi": {
    "flow_risk": {
      "35": {
        "risk": "Susp Entropy",
        "severity": "Low",
        "risk_score": {
          "total": 210,
          "client": 165,
          "server": 45
        }
      }
    },
    "confidence": {
      "1": "Match by port"
    },
    "proto": "SSH",
    "proto_id": "92",
    "encrypted": 1,
    "breed": "Acceptable",
    "category_id": 12,
    "category": "RemoteAccess",
    "ssh": {
      "client_signature": "",
      "server_signature": "",
      "hassh_client": "",
      "hassh_server": ""
    }
  }
}

Thank you in advance for your help!

Source: arkime/arkime

View original on GitHub View discussion on GitHub