Project

General

Profile

Actions

Feature #5082

closed

smb: keyword for matching the SMB files

Added by Eloy Pérez over 2 years ago. Updated about 2 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

It would be nice to have a keyword that allows to match the filenames that are being accessed/created through smb create requests.

Actions #1

Updated by Philippe Antoine about 2 years ago

  • Status changed from New to In Review
Actions #2

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-beta1 to 7.0.0-rc1
Actions #3

Updated by Victor Julien over 1 year ago

  • Target version changed from 7.0.0-rc1 to 8.0.0-beta1
Actions #4

Updated by Jason Ish 10 months ago

  • Status changed from In Review to New
  • Assignee changed from Eloy Pérez to Community Ticket

Changing status to new as the pull request has gone stale: https://github.com/OISF/suricata/pull/7337

Actions #5

Updated by Jason Taylor 9 months ago

  • Assignee changed from Community Ticket to Jason Taylor
Actions #6

Updated by Jason Taylor 2 months ago

Looking at this ticket again and the functionality, it seems like the desired functionality is available from the file.name keyword today. I tested the suricata-verify tests that were created along with the pull request and those pcaps fire the expected alerts using file.name.

What are the thoughts around continuing this work?

Actions #7

Updated by Jason Taylor about 2 months ago

  • Status changed from New to Resolved
Actions #8

Updated by Jason Taylor about 2 months ago

  • Status changed from Resolved to Closed
Actions

Also available in: Atom PDF