Project

General

Profile

Actions

Task #6308

open

detect/analyzer: add more keyword details

Added by Juliana Fajardini Reichow 8 months ago. Updated about 1 month ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

This is an umbrella ticket.

When running Suricata with --engine-analysis mode (https://docs.suricata.io/en/latest/command-line-options.html?highlight=engine%20analysis#cmdoption-engine-analysis), the engine generates a profile report on whatever rules it had as input. See more at https://docs.suricata.io/en/latest/configuration/suricata-yaml.html?highlight=engine-analysis#engine-analysis.

The purpose of this task is to improve the said report, specifically the `postmatch` section, which expands the keyword matches for each rule.

The main goal is to expose the keyword's properties for a JSON object in the key-value format.

The keyword will have corresponding source files that will help you know what is the keyword name recognized by the engine, as well as the other fields we are interested in exposing to the engine analysis report.

The details about the keyword should be used to create the JSON object, named after the keyword you're working with.
The JsonBuilder will have the needed functions for that.

Feel free to use the listed PR here, as well as existing code in detect-engine-analyzer.c function DumpMatches, as examples.

This commit shows an example for adding details for byte_test and byte_jump - https://github.com/OISF/suricata/pull/8625/commits/325000ca2bd72edd802122a3d25988183622a69f

This PR contains work for adding details to the `ipopts` keyword: https://github.com/OISF/suricata/pull/9487
please note how the PR also links a Suricata-verify related work for testing the new output: https://github.com/OISF/suricata-verify/pull/1387


Subtasks 16 (11 open5 closed)

Task #6309: detect/analyzer: add more details for the flowbits keywordClosedHadiqa Alamdar BukhariActions
Task #6310: detect/analyzer: add more details for the ttl keywordNewCommunity TicketActions
Task #6311: detect/analyzer: add more details for the flowint keywordNewCommunity TicketActions
Task #6312: detect/analyzer: add more details for the flow.age keywordNewCommunity TicketActions
Task #6348: detect/analyzer: add more details for the ipopts keywordClosedJuliana Fajardini ReichowActions
Task #6350: detect/analyzer: add more details for the tcp.flags keywordNewCommunity TicketActions
Task #6351: detect/analyzer: add more details for the xbits keywordNewCommunity TicketActions
Task #6352: detect/analyzer: add more details for the tcp window keywordNewCommunity TicketActions
Task #6353: detect/analyzer: add more details for the tcp seq keywordClosedDaniel OlatunjiActions
Task #6354: detect/analyzer: add more details for the tcp ack keywordClosedDaniel OlatunjiActions
Task #6355: detect/analyzer: add more details for the tcp.mss keywordClosedDaniel OlatunjiActions
Task #6356: detect/analyzer: add more details for the tcp.hdr keywordNewCommunity TicketActions
Task #6357: detect/analyzer: add more details for the dsize keywordNewCommunity TicketActions
Task #6358: detect/analyzer: add more details for the ICMP itype keywordNewCommunity TicketActions
Task #6359: detect/analyzer: add more details for the ICMP icode keywordNewCommunity TicketActions
Task #6360: detect/analyzer: add more details for the icmp_id keywordNewCommunity TicketActions
Actions

Also available in: Atom PDF