Feature #1830: support 'tag' in eve log - Suricata - Open Information Security Foundation

Actions

Copy link

Feature #1830

closed

VJ JI

support 'tag' in eve log

Feature #1830: support 'tag' in eve log

Added by Victor Julien almost 10 years ago. Updated over 9 years ago.

Status:

Closed

Priority:

Normal

Assignee:

Jason Ish

Target version:

3.1.2

Effort:

Difficulty:

Label:

Description

When using the tag keyword special tag records are being written out to unified2. This way more packets than just the one triggering the alert are logged.

Eve should support the same thing. Probably through the 'alert' record with a special sid/gid like in unified2.

JI Updated by Jason Ish over 9 years ago Actions
Copy link
#1

Actually unified2 doesn't have the special alert record with the tagged gid/sid anymore. A packet is a discrete record that contains an "event_id" and "event_second" to associate with the alert record previously seen in the unified file.

I thought we could do something similar, a "packet" eve record?