Project

General

Profile

Actions

Feature #2167

open

eve-ng

Added by Victor Julien almost 7 years ago. Updated 7 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Parts of EVE are not working as well as we want. Changing those would be a breaking change in some cases. Consider a new version of eve that is free to break things.

Some initial notes:

  • config format: the 'types' list should be a map instead
  • config format: much too verbose
  • config format 'eve-log' should just be 'eve'
  • config should have better defaults
  • output of buffers, see #2166
  • output of DNS is too verbose #2086 #1198
  • output HTTP: fix typos like #2000
  • output HTTP: http.http_user_agent is redundant. Could just be http.user_agent

Related issues 5 (4 open1 closed)

Related to Suricata - Bug #2000: eve.http: http_refer should be http_refererRejectedActions
Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Bug #6458: eve/http: discrepancy in http events and http objects logged in alertsNewOISF DevActions
Related to Suricata - Bug #6400: log of DNS answer is in wrong direction NewEric LeblondActions
Related to Suricata - Feature #4853: eve: Add information about Suricata versionAssignedJuliana Fajardini ReichowActions
Actions

Also available in: Atom PDF