Project

General

Profile

Feature #4089

rules: Flexible format transform

Added by Jeff Lucovsky 8 months ago. Updated 7 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
medium
Difficulty:
medium
Label:

Description

A transform that could combine existing sticky buffer values according to a format string in a transform would provide a power facility to shift rules based on specific hosts/path combinations into a dataset and hence, craft a rule like the following:

alert http any any -> any any (format("{}/{}", http.host, http.uri); dataset: isset, url-bl;)

The values for http.host and http.uri are combined into a string, eg., http://somehost/some/path/that/is/suspicious.

The format transform generates the string and then it's checked against a URL blacklist.


Related issues

Related to Task #4097: Suricon 2020 brainstormNewVictor JulienActions
#1

Updated by Jeff Lucovsky 8 months ago

Instead of "format("{}/{}", http.host, http.uri)" --> format:"{}/{}, http.host, http.uri"

Or perhaps with clearer intent:

http.host:"hostvar"; http.uri:"urivar";format:"{}/{}, hostvar, urivar";

Or maybe

alert http any any -> any any (http.host:sticky:http_host;content:"a";format:"{}/{}, sticky:http_host";)

#2

Updated by Jeff Lucovsky 7 months ago

  • Related to Task #4097: Suricon 2020 brainstorm added
#3

Updated by Victor Julien 7 months ago

  • Subject changed from Flexible format transform to rules: Flexible format transform
  • Status changed from New to Assigned
  • Assignee set to Jeff Lucovsky

Also available in: Atom PDF