http-body and http-body-printable in eve-log require metadata to be enabled, yet there is no indication of this anywhere
In Suricata when enabling outputs.eve-log.types.alert.http-body or .http-body-printable, it is required that either outputs.eve-log.types.alert.metadata or outputs.eve-log.types.alert.http be enabled. Otherwise there is no output in the eve-log.
If this is intentional to require metadata be enabled, then it should at least be documented in the standard documentation and/or in suricata.yaml next to the config option. Another suggestion would be to have this embedded under outputs.eve-log.types.alert.metadata or .http if metadata is required in order for body logging to occur.
- Start with the default suricata.yaml config file.
- Set outputs.eve-log.types.alert.metadata to no.
- Set outputs.eve-log.types.alert.http-body and/or outputs.eve-log.types.alert.http-body-printable to yes.
- Generate HTTP traffic that will cause some alert to trigger.
There is no http-body/http-body-response data in the eve-log. If this is by design, I was not able to find documentation supporting it.
This behavior should at a minimum be documented. It would be more self-documented if the config option was nested under the metadata config option.
Updated by Eric Urban over 3 years ago
The current default config from suricata.yaml makes this confusing since the other options indented to the same level as http-body are not dependent on another config option at that same level in order to be enabled. For example, payload will be logged regardless of whether or not packet or metadata are enabled.
types: - alert: # payload: yes # enable dumping payload in Base64 # payload-buffer-size: 4kb # max size of payload buffer to output in eve-log # payload-printable: yes # enable dumping payload in printable (lossy) format # packet: yes # enable dumping of packet (without stream segments) # http-body: yes # enable dumping of http body in Base64 # http-body-printable: yes # enable dumping of http body in printable format metadata: yes # add L7/applayer fields, flowbit and other vars to the alert