Bug #5814
closedsmb: duplicate interface fields logged
Description
The following tests result in duplicate interface fields being logged:
FAIL: ./tests/smb2-02/output/eve.json: key=interface, equal=True current value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}, new value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}
FAIL: ./tests/smb2-03-rule/output/eve.json: key=interface, equal=True current value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}, new value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}
FAIL: ./tests/smb2-07-frames/output/eve.json: key=interface, equal=True current value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}, new value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}
FAIL: ./tests/smb2-07/output/eve.json: key=interface, equal=True current value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}, new value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}
FAIL: ./tests/dcerpc-smb-test-01/output/eve.json: key=interface, equal=True current value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}, new value={'uuid': '367abb81-9844-35f1-ad32-98f038001003', 'version': '2.0'}
FAIL: ./tests/smb2-08-rule/output/eve.json: key=interface, equal=True current value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}, new value={'uuid': '4b324fc8-1670-01d3-1278-5a47bf6ee188', 'version': '3.0'}
These should probably be put into an array named "interfaces". The curious bit is that the duplicates are equal.
@Eric Leblond Any thoughts there as this will change the structure of the event.
Updated by Jason Ish about 1 year ago
- Related to Feature #5413: DCERPC logging is not easy to use in analysis added
Updated by Eric Leblond about 1 year ago
Yes, it really makes sense to use an interfaces object. But when looking at the data, it looks like we have twice the same one. Are we missing a other value or it is a duplicate ?
Updated by Eric Leblond about 1 year ago
I think the function call is supposed to be unique so we may miss something here.
Updated by Victor Julien about 1 year ago
- Status changed from New to In Review
- Assignee changed from OISF Dev to Jason Ish
Updated by Jason Ish about 1 year ago
Eric Leblond wrote in #note-3:
I think the function call is supposed to be unique so we may miss something here.
So no more or less data is being logged. The fix is to go from an JSON that looks like:
{
...,
interface: {"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188", "version": "3.0"},
interface: {"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188", "version": "3.0"},
...,
}
to:
{
...,
interfaces: [
{"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188", "version": "3.0"},
{"uuid": "4b324fc8-1670-01d3-1278-5a47bf6ee188", "version": "3.0"},
],
...,
}
So all logged interfaces will remain visible after decoding the JSON.
Updated by Victor Julien about 1 year ago
- Status changed from In Review to Closed