Project

General

Profile

Actions

Feature #4089

open

rules: Flexible format transform

Added by Jeff Lucovsky over 2 years ago. Updated 6 months ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Effort:
medium
Difficulty:
medium
Label:

Description

A transform that could combine existing sticky buffer values according to a format string in a transform would provide a power facility to shift rules based on specific hosts/path combinations into a dataset and hence, craft a rule like the following:

alert http any any -> any any (format("{}/{}", http.host, http.uri); dataset: isset, url-bl;)

The values for http.host and http.uri are combined into a string, eg., http://somehost/some/path/that/is/suspicious.

The format transform generates the string and then it's checked against a URL blacklist.


Related issues 1 (1 open0 closed)

Related to Task #4097: Suricon 2020 brainstormAssignedVictor JulienActions
Actions

Also available in: Atom PDF