Suricata

Dumping some notes about what this could look like.

The idea here is to add a new 'config' action with a 'config' keyword that would allow the rule writer to enable/disable certain features for a certain scope.

config tcp any any -> any any (config:<subsys>, <enable>, type <subtype>, scope <scope>; .. )

config tcp any any -> any any (config:logging, disable, type file, scope flow; .. )
config http any any -> any any (http.uri; content:"/index.html"; config:logging, disable, type file, scope flow; .. )
config dns any any -> any any (dns.query; content:"google.com"; endswith; config:logging, disable, type proto, scope tx; .. )

config
  logging:
    state: enable/disable
    type:
      proto (depends on alproto, so http, smb, etc)
      file
      alert
      drop
    scope:
      packet
      flow
      tx
      file
      src_ip
      dest_ip
      ip_pair
  bypass:
    state: enable/disable
    scope:
      flow
      src_ip
      dest_ip
      ip_pair
  inspect (pass):
    state: enable/disable
    type:
      packet
      payload
      applayer
      file
      stream-events (config ... (stream_is_lossy; config:inspect, disable, type stream-events, scope flow; ...))
    scope:
      packet
      flow
      tx
      file
      src_ip
      dest_ip
      ip_pair