Project

General

Profile

Actions

Documentation #5494

closed

userguide: update tls eve-log fields 'not_before' and 'not_after'

Added by Juliana Fajardini Reichow almost 2 years ago. Updated 5 months ago.

Status:
Closed
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

It was reported that our documentation mentioned the tls fields 'not_before' and 'not_after'
as possible custom fields for the tls events in our eve-log, whereas in fact the fields
themselves are written as 'notbefore' and 'notafter', which led to confusion for folks trying
to follow the documentation to parse our logs.

Our documentation: https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html#id10
Example check for our eve-log: https://github.com/OISF/suricata-verify/blob/master/tests/bug-2646-01/test.yaml#L20

Update our documentation to reflect what is seen in our logs.


Subtasks 3 (0 open3 closed)

Documentation #6505: userguide: update tls eve-log fields 'not_before' and 'not_after' (6.0.x backport)ClosedActions
Documentation #6512: userguide: update tls eve-log fields 'not_before' and 'not_after' (6.0.x backport)ClosedJuliana Fajardini ReichowActions
Documentation #6513: userguide: update tls eve-log fields 'not_before' and 'not_after' (7.0.x backport)ClosedJuliana Fajardini ReichowActions

Related issues 1 (1 open0 closed)

Related to Suricata - Documentation #6288: eve/schema: generate tables of data for app-layer protocolsIn ProgressJason IshActions
Actions

Also available in: Atom PDF