Project

General

Profile

Feature #2096

eve: event_type for MODBUS

Added by Austin Taylor about 4 years ago. Updated about 1 month ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Here is an example of the type of event I'm looking for with MODBUS, but this is for DNP3.

{"timestamp":"2015-10-22T04:46:25.989814-0400","flow_id":719070443301326,"pcap_cnt":837127,"event_type":"*dnp3*","src_ip":"192.168.2.166","src_port":2142,"dest_ip":"192.168.88.95","dest_port":20000,"proto":"TCP","dnp3":{"type":"request","control":{"dir":true,"pri":true,"fcb":false,"fcv":false,"function_code":4},"src":1,"dst":1024,"application":{"control":{"fir":true,"fin":true,"con":false,"uns":false,"sequence":1},"function_code":1,"objects":[{"group":60,"variation":2,"qualifier":6,"prefix_code":0,"range_code":6,"start":0,"stop":0,"count":0}],"complete":true}}}

Would like to have similar event_type generated but with MODBUS fields.


Related issues

Related to Optimization #2782: Convert Modbus from C to RustRejectedActions
Related to Feature #3957: Convert protocol to Rust: ModbusClosedSimon DugasActions
#1

Updated by Victor Julien about 4 years ago

  • Description updated (diff)
  • Assignee set to Anonymous
  • Priority changed from High to Normal
  • Target version changed from 70 to TBD
#2

Updated by Victor Julien about 4 years ago

  • Subject changed from Add event_type for MODBUS to eve: event_type for MODBUS
#3

Updated by Eric Leblond about 4 years ago

  • Assignee changed from Anonymous to Eric Leblond
#4

Updated by Victor Julien over 1 year ago

#5

Updated by Victor Julien over 1 year ago

  • Assignee changed from Eric Leblond to OISF Dev
#6

Updated by Shivani Bhardwaj 8 months ago

  • Related to Feature #3957: Convert protocol to Rust: Modbus added
#7

Updated by Simon Dugas 5 months ago

Sample output is shown in this pull request which may implement this ticket:
- https://github.com/OISF/suricata/pull/5750

#8

Updated by Philippe Antoine 3 months ago

  • Status changed from New to In Review
#9

Updated by Victor Julien about 1 month ago

  • Status changed from In Review to Closed
  • Assignee changed from OISF Dev to Simon Dugas
  • Target version changed from TBD to 7.0rc1

Also available in: Atom PDF