Project

General

Profile

Actions

Bug #2017

closed

EVE Log Missing Fields

Added by Ryan Cote almost 5 years ago. Updated almost 5 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

A sanitized testing version has the signature below:

alert ip [192.168.1.1,192.168.1.2] any -> ![192.168.1.0/24,192.168.2.0/24] any (msg:"Testing missing field alert"; sid:999999; rev:1;)

Which constantly repeats this output output:

{"timestamp":"2017-02-03T20:56:28.449174+0000","alert": {"action":"allowed","gid":1,"signature_id":999999,"rev":1,"signature":"Testing missing field alert","category":"","severity":3}}

The capture method is PFRING and the EVE Output configuration is below:

- eve-log:
enabled: yes
filetype: regular
filename: eve.json
types:
- alert:
payload-printable: yes
payload: yes
http: yes
tls: yes
ssh: yes
smtp: yes

I can run a more thorough sanitized test as more information is required


Files

suricata.yaml (62.4 KB) suricata.yaml Ryan Cote, 02/03/2017 09:29 PM
alert.json (3.39 KB) alert.json Ryan Cote, 02/03/2017 09:29 PM
suri_timestamp.PNG (92.6 KB) suri_timestamp.PNG Ryan Cote, 02/03/2017 10:33 PM
Actions

Also available in: Atom PDF