Actions
Feature #6079
closedeve/dcerpc: eve/smb: log dcerpc uuid with request/response txs
Effort:
Difficulty:
Label:
Description
Need the UUID with the opnum.
Updated by Juliana Fajardini Reichow 12 months ago
- Target version changed from 7.0.0-rc2 to 8.0.0-beta1
Updated by Shivani Bhardwaj about 1 month ago
It seems to me that this feature is already in place. If an SMB request is DCERPC and has interfaces, they are logged along with the opnum.
Code where this happens: https://github.com/OISF/suricata/blob/master/rust/src/smb/log.rs#L334
Also verified in the existing s-v test smb-dce_opnum.
@Peter Manev I remember you coming up with this issue. Could you please verify this is up to your expectations or if I am misunderstanding what's needed?
Updated by Shivani Bhardwaj 9 days ago
- Status changed from Assigned to Closed
I believe this is already done in the code. If it is not as per the expectations, please feel free to reopen with clear expectations.
Actions