Project

General

Profile

Actions
Copy link

Feature #2054

closed

Extracting HTTPS URL´s from SMTP, currently only HTTP is supported

Added by Per Le almost 8 years ago. Updated almost 3 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Aaron Bungay
Target version:
7.0.0-beta1
Effort:
medium
Difficulty:
medium
Label:

Description

Hello :)
We are looking for extracting HTTPS URL´s from SMTP. Currently, only HTTP is supported
Can you please add this?

Related issues 1 (0 open — 1 closed)

Has duplicate Suricata - Feature #2724: extract-urls in email mime decoder increasingly obsoleteRejectedActions
Actions
Copy link
 #1

Updated by Andreas Herz over 7 years ago

  • Assignee set to OISF Dev
  • Target version set to TBD
Actions
Copy link
 #2

Updated by Drew G about 7 years ago

Ideally, it would be great if this had some granularity that was configurable. Something like:

#Default (same result as current code)
extract-urls: yes
extract-urls-schemes: [http]
log-url-scheme: no

eve.json ->

...,"url":["suricata-ids.org"],...


#Proposed Feature
extract-urls: yes
extract-urls-schemes: [http, https, ftp, mailto]
log-url-scheme: yes

eve.json ->

...,"url":["http:\/\/suricata-ids.org","https:\/\/suricata-ids.org"],...

Actions
Copy link
 #3

Updated by Victor Julien about 7 years ago

  • Assignee changed from OISF Dev to Anonymous

I like the idea. Happy to take a pull request.

Actions
Copy link
 #4

Updated by Victor Julien over 6 years ago

  • Effort set to medium
  • Difficulty set to medium
Actions
Copy link
 #5

Updated by Victor Julien about 6 years ago

  • Has duplicate Feature #2724: extract-urls in email mime decoder increasingly obsolete added
Actions
Copy link
 #6

Updated by Andreas Herz almost 6 years ago

  • Assignee set to Community Ticket
Actions
Copy link
 #7

Updated by Aaron Bungay over 4 years ago

Looking into this.

Actions
Copy link
 #9

Updated by Victor Julien over 4 years ago

  • Status changed from New to In Review
  • Assignee changed from Community Ticket to Aaron Bungay
  • Target version changed from TBD to 6.0.0beta1
Actions
Copy link
 #10

Updated by Victor Julien over 4 years ago

  • Target version changed from 6.0.0beta1 to 7.0.0-beta1
Actions
Copy link
 #11

Updated by Victor Julien almost 3 years ago

  • Status changed from In Review to Closed
Actions
Copy link

Also available in: Atom PDF