Project

General

Profile

Actions
Copy link

Bug #6458

open

eve/http: discrepancy in http events and http objects logged in alerts

Added by Jason Ish about 1 year ago. Updated about 1 year ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
TBD
Affected Versions:
Effort:
Difficulty:
Label:

Description

For example, the HTTP object in an HTTP record might be different than the HTTP object in an alert object.

The same has been seen in DNS and is likely to be seen in other protocols.

Related issues 3 (2 open — 1 closed)

Related to Suricata - Feature #6456: output: binary loggingNewOISF DevActions
Related to Suricata - Task #2167: tracking: eve enhancementsNewOISF DevActions
Related to Suricata - Bug #6281: dns: structure of query differs between "alert" and "dns" event typesClosedJason IshActions
Actions
Copy link
 #1

Updated by Jason Ish about 1 year ago

Actions
Copy link
 #2

Updated by Jason Ish about 1 year ago

  • Description updated (diff)
Actions
Copy link
 #3

Updated by Victor Julien about 1 year ago

  • Related to Task #2167: tracking: eve enhancements added
Actions
Copy link
 #4

Updated by Philippe Antoine 11 months ago

  • Related to Bug #6281: dns: structure of query differs between "alert" and "dns" event types added
Actions
Copy link

Also available in: Atom PDF