Project

General

Profile

Actions
Copy link

Optimization #3304

open

generic way to register buffers for logging and detection

Added by Andreas Herz over 4 years ago. Updated 5 months ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Effort:
Difficulty:
Label:

Description

Currently creating support for logging protocol fields and matching protocol fields are distinct steps during development.

Goal is to unify this so the protocol parser implementations simply register a buffer/field once.

Related issues 2 (2 open — 0 closed)

Related to Suricata - Task #3288: Suricon 2019 brainstormAssignedVictor JulienActions
Related to Suricata - Task #4101: tracking: pluginsIn ProgressJason IshActions
Actions
Copy link
 #1

Updated by Victor Julien over 4 years ago

  • Subject changed from Make sure output of protocol parsers and keywords are both supported to generic way to register buffers for logging and detection
  • Description updated (diff)
Actions
Copy link
 #2

Updated by Victor Julien over 4 years ago

  • Parent task deleted (#3288)
Actions
Copy link
 #3

Updated by Victor Julien over 4 years ago

  • Related to Task #3288: Suricon 2019 brainstorm added
Actions
Copy link
 #4

Updated by Victor Julien over 3 years ago

Actions
Copy link
 #5

Updated by Philippe Antoine over 1 year ago

As I see it, the main problem is that detection requires redmine ticket + suricata-verify test + documentation when logging does not

Actions
Copy link
 #6

Updated by Philippe Antoine 5 months ago

Idea about this : using magic rust derive that would parse a struct and see which fiels are annotated for logging and/or detection and create functions to log them or get the buffer/integer for detection

Actions
Copy link

Also available in: Atom PDF