Project

General

Profile

Actions

Task #6463

open

eve/output: investigate how to track coverage / parity

Added by Juliana Fajardini Reichow 7 months ago. Updated 7 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:
Outreachy

Description

We want to find a reliable and efficient way to track the outputs that we have on eve, to ensure they're
consistent and that we have everything represented in our JSON schema.


Related issues 3 (3 open0 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Documentation #6478: schema: add missing fieldsNewCommunity TicketActions
Related to Suricata - Task #4772: tracking: parity between fields logged and fields available for detectionAssignedVictor JulienActions
Actions #1

Updated by Juliana Fajardini Reichow 7 months ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions #2

Updated by Juliana Fajardini Reichow 7 months ago

  • Subject changed from outputs: investigate how to track coverage / parity to eve/output: investigate how to track coverage / parity

This also relates to ensuring that for each protocol, there are no logging discrepancies when we log a field in an alert and in an event, for instance.

Actions #3

Updated by Victor Julien 6 months ago

Actions #4

Updated by Juliana Fajardini Reichow 6 months ago

  • Related to Task #4772: tracking: parity between fields logged and fields available for detection added
Actions

Also available in: Atom PDF