Project

General

Profile

Actions
Copy link

Feature #1948

closed
DH JI

allow filestore name configuration options

Feature #1948: allow filestore name configuration options

Added by Duane Howard over 9 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
4.1beta1
Effort:
Difficulty:
Label:

Description

It would be useful to configure patterns for file names for file extraction to give us more control over the filenames when using file_store.

Currently we just get file.1, file.2 etc. Setting the file name to a hash (sha256 preferably) would be helpful.

Related issues 2 (1 open — 1 closed)

Related to Suricata - Task #2309: SuriCon 2017 brainstormAssignedVictor JulienActions
Related to Suricata - Feature #2303: file-store enhancements (aka file-store v2): deduplication; hash-based naming; json metadata and cleanup toolingClosedJason IshActions

VJ Updated by Victor Julien over 9 years ago Actions
Copy link
 #1

I like the idea to use the hash as file name. Would a global switch be ok for that?

DH Updated by Duane Howard over 9 years ago Actions
Copy link
 #2

For us I think that would be fine. Not sure if others would have the need to be able to specify paths, and/or patterns (timestamps, src/dst, etc.)

VJ Updated by Victor Julien over 9 years ago Actions
Copy link
 #3

I guess this mean we first start writing to a temporary filename and then when it's done rename the file to the hash name.

AH Updated by Andreas Herz almost 9 years ago Actions
Copy link
 #4

  • Assignee set to Anonymous
  • Target version set to TBD

VJ Updated by Victor Julien over 8 years ago Actions
Copy link
 #5

  • Related to Task #2309: SuriCon 2017 brainstorm added

VJ Updated by Victor Julien over 8 years ago Actions
Copy link
 #6

  • Related to Feature #2303: file-store enhancements (aka file-store v2): deduplication; hash-based naming; json metadata and cleanup tooling added

VJ Updated by Victor Julien over 8 years ago Actions
Copy link
 #7

  • Status changed from New to Closed
  • Assignee changed from Anonymous to Jason Ish
  • Target version changed from TBD to 4.1beta1

https://github.com/OISF/suricata/pull/3175 implements sha256 hash as file names

Actions
Copy link

Also available in: PDF Atom