Project

General

Profile

Actions

Task #6308

open
JF OD

detect/analyzer: add more keyword details

Task #6308: detect/analyzer: add more keyword details

Added by Juliana Fajardini Reichow over 2 years ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

This is an umbrella ticket.

When running Suricata with --engine-analysis mode (https://docs.suricata.io/en/latest/command-line-options.html?highlight=engine%20analysis#cmdoption-engine-analysis), the engine generates a profile report on whatever rules it had as input. See more at https://docs.suricata.io/en/latest/configuration/suricata-yaml.html?highlight=engine-analysis#engine-analysis.

The purpose of this task is to improve the said report, specifically the `postmatch` section, which expands the keyword matches for each rule.

The main goal is to expose the keyword's properties for a JSON object in the key-value format.

The keyword will have corresponding source files that will help you know what is the keyword name recognized by the engine, as well as the other fields we are interested in exposing to the engine analysis report.

The details about the keyword should be used to create the JSON object, named after the keyword you're working with.
The JsonBuilder will have the needed functions for that.

Feel free to use the listed PR here, as well as existing code in detect-engine-analyzer.c function DumpMatches, as examples.

This commit shows an example for adding details for byte_test and byte_jump - https://github.com/OISF/suricata/pull/8625/commits/325000ca2bd72edd802122a3d25988183622a69f

This PR contains work for adding details to the `ipopts` keyword: https://github.com/OISF/suricata/pull/9487
please note how the PR also links a Suricata-verify related work for testing the new output: https://github.com/OISF/suricata-verify/pull/1387


Subtasks 16 (3 open13 closed)

Task #6309: detect/analyzer: add more details for the flowbits keywordClosedHadiqa Alamdar BukhariActions
Task #6310: detect/analyzer: add more details for the ttl keywordClosedOlusegun FajobiActions
Task #6311: detect/analyzer: add more details for the flowint keywordClosedOlusegun FajobiActions
Task #6312: detect/analyzer: add more details for the flow.age keywordClosedAlice da Silva AkakiActions
Task #6348: detect/analyzer: add more details for the ipopts keywordClosedJuliana Fajardini ReichowActions
Task #6350: detect/analyzer: add more details for the tcp.flags keywordAssignedCommunity TicketActions
Task #6351: detect/analyzer: add more details for the xbits keywordClosedJames KadduActions
Task #6352: detect/analyzer: add more details for the tcp window keywordClosedNancy EnosActions
Task #6353: detect/analyzer: add more details for the tcp seq keywordClosedDaniel OlatunjiActions
Task #6354: detect/analyzer: add more details for the tcp ack keywordClosedDaniel OlatunjiActions
Task #6355: detect/analyzer: add more details for the tcp.mss keywordClosedDaniel OlatunjiActions
Task #6356: detect/analyzer: add more details for the tcp.hdr keywordNewCommunity TicketActions
Task #6357: detect/analyzer: add more details for the dsize keywordClosedJeff LucovskyActions
Task #6358: detect/analyzer: add more details for the ICMP itype keywordAssignedCommunity TicketActions
Task #6359: detect/analyzer: add more details for the ICMP icode keywordClosedJeff LucovskyActions
Task #6360: detect/analyzer: add more details for the icmp_id keywordClosedAlice da Silva AkakiActions

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #1

  • Subtask #6309 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #2

  • Subtask #6310 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #3

  • Subtask #6311 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #4

  • Subtask #6312 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #5

  • Subtask #6348 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #6

  • Subtask #6350 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #7

  • Subtask #6351 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #8

  • Subtask #6352 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #9

  • Subtask #6353 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #10

  • Subtask #6354 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #11

  • Subtask #6355 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #12

  • Subtask #6356 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #13

  • Subtask #6357 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #14

  • Subtask #6358 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #15

  • Subtask #6359 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #16

  • Subtask #6360 added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #17

  • Description updated (diff)

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions #18

  • Description updated (diff)

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions #19

  • Target version changed from 8.0.0-beta1 to 8.0.0

PA Updated by Philippe Antoine 10 months ago Actions #20

  • Target version changed from 8.0.0 to 9.0.0-beta1
Actions

Also available in: PDF Atom