Project

General

Profile

Feature #385

Configuration option to log all known (pcap) data for a stream when an alert fires

Added by David Wharton over 7 years ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

This is a request to be able to configure Suricata to log as much of a stream that it can leading up to an alert. For example, if an alert is generated, this configuration directive would tell Suricata to log as much of the stream that it knows about (e.g. what is in memory) up until and including the data that caused the alert, to disk. Data after an alert can be set by tagging directives but I think it would be handy to be able to configure Suricata to log all traffic it has in memory for a stream that generates an alert. Logging of network data would of course be in libpcap format (see also Feature #384 -- https://redmine.openinfosecfoundation.org/issues/384).


Related issues

Related to Support #2309: SuriCon 2017 brainstormNew12/01/2017Actions
Related to Feature #120: Capture full session on alertNewActions
Related to Feature #2219: Save pcap only if alertAssigned10/04/2017Actions
Related to Support #2685: SuriCon 2018 brainstormNewActions

History

#1

Updated by Victor Julien over 7 years ago

  • Assignee set to OISF Dev
  • Priority changed from Low to Normal
  • Target version set to TBD

In case of an alert generated based on the application layer state (e.g. HTTP), this is already what we do in Unified2. For raw stream alerts we can probably try to do that as well.

#2

Updated by Victor Julien over 1 year ago

#3

Updated by Victor Julien about 1 year ago

  • Related to Feature #120: Capture full session on alert added
#4

Updated by Victor Julien about 1 year ago

#5

Updated by Raymond Hansen 9 months ago

  • Assignee changed from OISF Dev to Maurizio Abba
#6

Updated by Victor Julien 9 months ago

#7

Updated by Victor Julien 4 months ago

Hi Maurizio, are you still planning to submit a PR for this?

Also available in: Atom PDF