Project

General

Profile

Actions

Bug #3087

open

Prelude output IDMEF message issue

Added by Andrew Goldy about 3 years ago. Updated about 3 years ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
low
Difficulty:
low
Label:

Description

Hello,

The Prelude Siem output (IDMEF) of Suricata might be confused from version 4.1.2. The alert.classification.text field which should contain the signature name (for example ET Policy...) swapped with alert.assessment.impact.description(classification for example Corporate policy violation). In other words after version 4.1.2 we see the classification instead of the signature name and in the description we could see the signature name where was previously the classification.
Could you please check it?

Thank you!


Files

prelude.PNG (3.05 KB) prelude.PNG Andrew Goldy, 08/08/2019 02:41 PM
prelude1.PNG (3.29 KB) prelude1.PNG Andrew Goldy, 08/08/2019 02:44 PM
Actions #1

Updated by Victor Julien about 3 years ago

  • Assignee set to Community Ticket
  • Target version set to TBD
Actions #2

Updated by Victor Julien about 3 years ago

I've pinged Thomas who has been maintaining this code recently.

Updated by Andrew Goldy about 3 years ago

To visualize the problem:

As the the prewikka console shows the text message is swapped with description.

Actions

Also available in: Atom PDF