Project

General

Profile

Actions

Feature #4089

open

rules: Flexible format transform

Added by Jeff Lucovsky 11 months ago. Updated 10 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
medium
Difficulty:
medium
Label:

Description

A transform that could combine existing sticky buffer values according to a format string in a transform would provide a power facility to shift rules based on specific hosts/path combinations into a dataset and hence, craft a rule like the following:

alert http any any -> any any (format("{}/{}", http.host, http.uri); dataset: isset, url-bl;)

The values for http.host and http.uri are combined into a string, eg., http://somehost/some/path/that/is/suspicious.

The format transform generates the string and then it's checked against a URL blacklist.


Related issues

Related to Task #4097: Suricon 2020 brainstormNewVictor JulienActions
Actions #1

Updated by Jeff Lucovsky 11 months ago

Instead of "format("{}/{}", http.host, http.uri)" --> format:"{}/{}, http.host, http.uri"

Or perhaps with clearer intent:

http.host:"hostvar"; http.uri:"urivar";format:"{}/{}, hostvar, urivar";

Or maybe

alert http any any -> any any (http.host:sticky:http_host;content:"a";format:"{}/{}, sticky:http_host";)

Actions #2

Updated by Jeff Lucovsky 10 months ago

  • Related to Task #4097: Suricon 2020 brainstorm added
Actions #3

Updated by Victor Julien 10 months ago

  • Subject changed from Flexible format transform to rules: Flexible format transform
  • Status changed from New to Assigned
  • Assignee set to Jeff Lucovsky
Actions

Also available in: Atom PDF