Verify IDS alerts · Documentation

alert verify tests a supplied alert against packet evidence. Keep rule-match reproducibility, suspicious behavior, and recommended action distinct: a matching signature is not automatically proof that malware executed.

Test the Koi fixture with Luna

This example uses the Desktop fixture and rule context from the test fixture. It does not claim that an individual EVE event was retained:

packetsafari alert verify \
  --model gpt-5.6-luna \
  --reasoning-effort low \
  --workflow fast \
  --format markdown \
  "$HOME/Desktop/PacketSafari-High-Value-PCAPs-2026-09-08/Small/22-koi-loader-full-infection.pcap" \
  'The test fixture records ET Open SID 2059750, revision 2: ET MALWARE Win32/Koi Stealer CnC Checkin (GET). The rule matches an established outbound HTTP GET whose URI contains php?id=&subid= followed by exactly eight alphanumeric characters through the end of the URI. Inspect HTTP requests and cite matching URI values, exact frames and endpoints. Assess rule-match reproducibility, maliciousness, actionability, and evidence-supported ATT&CK mappings separately. No individual EVE alert timestamp or frame was retained.'

The file must exist locally. For your own incident, replace both the path and alert description. Include the actual SID/revision, rule text or match conditions, and any timestamp, source/destination tuple or flow ID you have. Do not invent missing alert metadata.

Submit an EVE JSON event

Save one alert event as alert.json, then run:

packetsafari alert verify "$HOME/Desktop/incident/capture.pcap" \
  --event alert.json --model gpt-5.6-luna --reasoning-effort low

--event reads a JSON event, not an entire multi-line EVE log. --envelope FILE accepts the PacketSafari normalized alert envelope. You can also use --capture-id CAPTURE_ID instead of a local PCAP path.

Request independent verification

Add --verify to the Fast command:

packetsafari alert verify "$HOME/Desktop/incident/capture.pcap" \
  --event alert.json --workflow fast --verify

Or use --tui for guided setup. For a full investigation with Triage and Final Report, choose --workflow progressive instead. These are different workflows.

What to check in the result

Look for exact frame/flow evidence, checked rule conditions, capture coverage, and limitations. A Fast result is not independently verified. Structured output includes assessment and verification status; read them together with the report.

An empty ATT&CK list means no mapping was returned; it is not a clean-capture verdict. Missing inspection tools or failed reads are runtime limitations, not evidence that the traffic is absent.

AI alert verification does not automatically mean the IDS engine reran the exact rule. Use --full-ids when you also want an IDS scan and check its separate status. Rules must be available and enabled in the deployment.

For an open-ended malware search, use investigate with the security goal instead of inventing an alert.