Project

General

Profile

Actions

Documentation #6096

open

eve/app-layer: generate example eve-log for each protocol

Added by Jason Ish about 2 years ago. Updated 1 day ago.

Status:
Assigned
Priority:
Normal
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:
Label:

Description

Instead of hard-coding in output examples for each protocol, we should generate from Suricata-Verify.

A possible way to do this is:

- Tag SV tests in such a way as examples, also provide their protocol name. This could allow existing tests be used.
- Periodically a script is run that runs SV and gathers sample output from tests and copies distinct records into files in the userguide.
- The userguide can then include these files.

Ideally SV tests that are tagged as examples are as complete as possible, containing all documented fields, however this might not always be possible.
Also allow for more than one example per protocol, as often multiple examples are needed to see request and response, or different message types.

The pcaps should be samll, and added to the Suricata repo, so the example documentation can be generated without an external repo like suricata-verify.


Subtasks 2 (2 open0 closed)

Documentation #6097: eve/dhcp: generate example dhcp outputNewJason IshActions
Documentation #6098: eve/dns: generate example dns outputNewJason IshActions
Actions #1

Updated by Jason Ish about 2 years ago

  • Subtask #6097 added
Actions #2

Updated by Jason Ish about 2 years ago

  • Subtask #6098 added
Actions #3

Updated by Jason Ish about 2 years ago

  • Subject changed from app-layer: generate example eve-log for each protocol to eve/app-layer: generate example eve-log for each protocol
Actions #4

Updated by Jason Ish 4 months ago

  • Description updated (diff)
Actions #5

Updated by Jason Ish 4 months ago

  • Target version changed from TBD to 8.0.0-rc1
Actions #6

Updated by Victor Julien about 1 month ago

  • Target version changed from 8.0.0-rc1 to 8.0.0
Actions #7

Updated by Victor Julien 25 days ago

  • Status changed from New to Assigned
  • Assignee changed from OISF Dev to Peter Manev
Actions #8

Updated by Victor Julien 7 days ago

  • Target version changed from 8.0.0 to 8.0.1
Actions #9

Updated by Peter Manev 1 day ago

What we agreed with Jason as a first step is to add example logs, then provide corresponding public pcaps and as a third step automate the process to be done/generated per release.

Actions

Also available in: Atom PDF