Suricata

• aa boolean field is missing in the answer array. It is present in dns object properties.
• tc boolean field is missing in the answer array.
• z boolean field is missing in the answer array. It is present for query array and dns object properties.
• I also don't see the sshfp field anywhere in the dns object while I do see the srv field in the answers array and soa field in the authorities array.

The fields which have been implemented include:
- dns.query
- dns.opcode
- dns.rcode : in progress
- dns.answer.name
- dns.query.name
Awaiting further instructions on which fields to implement first.

Hadiqa Alamdar Bukhari wrote in #note-7:

The fields which have been implemented include:
- dns.query
- dns.opcode
- dns.rcode : in progress
- dns.answer.name
- dns.query.name
Awaiting further instructions on which fields to implement first.

- rtype would be a good next one, it would be much like opcode or rcode
- then maybe "a" and "aaaa", which are more similar to dns.answer.name as they would be sticky buffers
- or some other protocol?

Jason Ish wrote in #note-8:

Hadiqa Alamdar Bukhari wrote in #note-7:

The fields which have been implemented include:
- dns.query
- dns.opcode
- dns.rcode : in progress
- dns.answer.name
- dns.query.name
Awaiting further instructions on which fields to implement first.

- rtype would be a good next one, it would be much like opcode or rcode
- then maybe "a" and "aaaa", which are more similar to dns.answer.name as they would be sticky buffers
- or some other protocol?

Got it, thanks!