https://redmine.openinfosecfoundation.org/https://redmine.openinfosecfoundation.org/favicon.ico?17011170022022-11-13T07:05:03ZOpen Information Security FoundationSuricata - Feature #5639: Allow dataset to match on extracted domainhttps://redmine.openinfosecfoundation.org/issues/5639?journal_id=254692022-11-13T07:05:03ZVictor Julienvictor@inliniac.net
<ul><li><strong>Related to</strong> <i><a class="issue tracker-2 status-1 priority-4 priority-default" href="/issues/5681">Feature #5681</a>: datasets: add more transform layers to match on domains</i> added</li></ul> Suricata - Feature #5639: Allow dataset to match on extracted domainhttps://redmine.openinfosecfoundation.org/issues/5639?journal_id=326422024-02-17T23:10:13ZEric Leblonderic@regit.org
<ul></ul><p>We stopped the discussion on which crate to use:<br />- <a class="external" href="https://crates.io/crates/publicsuffix">https://crates.io/crates/publicsuffix</a><br />- <a class="external" href="https://crates.io/crates/psl">https://crates.io/crates/psl</a><br />What should we do here ?</p>
<p>Both crates are from the same author. Psl has a list built at compile time but it is supposed to be faster than publicsuffix. This last one load a file that will need to be provided by suricata or installer if we want the feature to work out of the box.</p>