Project

General

Profile

Actions
Copy link

Feature #6161

open
AH AH

file-store: missing hash on TRUNCATED files

Feature #6161: file-store: missing hash on TRUNCATED files

Added by Andreas Herz almost 3 years ago. Updated 1 day ago.

Status:
Feedback
Priority:
Normal
Assignee:
Andreas Herz
Target version:
TBD
Effort:
Difficulty:
Label:

Description

While `sha256` is always seen, when we also enable `md5` and/or `sha1` via `force-hash` they are not shown in the log for files being flagged TRUNCATED.

Related issues 2 (2 open — 0 closed)

Related to Suricata - Feature #4279: Optionally allow hashing truncated files, and a maximum length to hashAssignedJeff WeeksActions
Related to Suricata - Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATEDNewFanny DwargeeActions

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #1

I think this is working as designed, so this ticket may be more a feature request...

PA Updated by Philippe Antoine 10 months ago Actions
Copy link
 #2

  • Status changed from Assigned to Feedback

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #3

  • Related to Feature #4279: Optionally allow hashing truncated files, and a maximum length to hash added

PA Updated by Philippe Antoine 9 months ago Actions
Copy link
 #4

  • Related to Feature #2147: fileinfo: sha1 hash not logged if state == TRUNCATED added

VJ Updated by Victor Julien 1 day ago Actions
Copy link
 #5

  • Tracker changed from Bug to Feature
  • Affected Versions deleted (6.0.13, 7.0.0-rc2)

@Andreas Herz is this a feature you care about?

Actions
Copy link

Also available in: PDF Atom