Project

General

Profile

Actions
Copy link

Task #6463

closed
JF JI

eve/output: investigate how to track coverage / parity

Task #6463: eve/output: investigate how to track coverage / parity

Added by Juliana Fajardini Reichow over 2 years ago. Updated 7 months ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
-
Effort:
Difficulty:
Label:
Outreachy

Description

We want to find a reliable and efficient way to track the outputs that we have on eve, to ensure they're
consistent and that we have everything represented in our JSON schema.

Related issues 4 (4 open — 0 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Documentation #6478: schema: add missing fieldsAssignedOISF DevActions
Related to Suricata - Task #4772: tracking: parity between fields logged and fields available for detectionAssignedVictor JulienActions
Related to Suricata - Story #7901: 9.0.0: rules: improve rules keyword/output parityAssignedVictor JulienActions

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions
Copy link
 #1

  • Related to Task #6443: Suricon 2023 brainstorm added

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions
Copy link
 #2

  • Subject changed from outputs: investigate how to track coverage / parity to eve/output: investigate how to track coverage / parity

This also relates to ensuring that for each protocol, there are no logging discrepancies when we log a field in an alert and in an event, for instance.

VJ Updated by Victor Julien over 2 years ago Actions
Copy link
 #3

JF Updated by Juliana Fajardini Reichow over 2 years ago Actions
Copy link
 #4

  • Related to Task #4772: tracking: parity between fields logged and fields available for detection added

JF Updated by Juliana Fajardini Reichow over 1 year ago Actions
Copy link
 #5

  • Blocks Story #6597: rules: improve rules keyword/output parity added

VJ Updated by Victor Julien about 1 year ago Actions
Copy link
 #6

  • Status changed from New to In Progress
  • Assignee changed from OISF Dev to Jason Ish

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #7

  • Blocks deleted (Story #6597: rules: improve rules keyword/output parity)

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #8

  • Related to Story #7901: 9.0.0: rules: improve rules keyword/output parity added

VJ Updated by Victor Julien 7 months ago Actions
Copy link
 #9

  • Status changed from In Progress to Closed
  • Target version deleted (TBD)
Actions
Copy link

Also available in: PDF Atom