Project

General

Profile

Actions

Documentation #6478

open

schema: add missing fields

Added by Philippe Antoine 6 months ago. Updated 4 months ago.

Status:
New
Priority:
Normal
Target version:
Affected Versions:
Effort:
Difficulty:
Label:
Beginner, Good First Issue, Outreachy

Description

With the addition of the JSON schema (see https://github.com/OISF/suricata/blob/master/etc/schema.json) and SV checks to validate it, it's important to ensure that it is complete.

Running git grep set_string rust/src/ | cut -d'"' -f2 | sort | uniq | grep -v : | while read i; do echo -n $i; git grep $i etc/schema.json | wc -l; done | awk '$2 == 0'

shows for instance that server_security_failure_reason is missing in etc/schema.json for rfb


Related issues 5 (5 open0 closed)

Related to Suricata - Task #6443: Suricon 2023 brainstormAssignedVictor JulienActions
Related to Suricata - Task #6463: eve/output: investigate how to track coverage / parityNewOISF DevActions
Related to Suricata - Optimization #6502: schema: avoid - and . in keysNewOISF DevActions
Related to Suricata - Documentation #6566: userguide: add description for missing EVE krb fieldsNewOISF DevActions
Related to Suricata - Task #6597: rules keyword/output parity: improveIn ProgressHadiqa Alamdar BukhariActions
Actions #1

Updated by Philippe Antoine 6 months ago

  • Related to Task #6443: Suricon 2023 brainstorm added
Actions #2

Updated by Philippe Antoine 6 months ago

  • Label Beginner added
Actions #3

Updated by Juliana Fajardini Reichow 6 months ago

  • Label Good First Issue, Outreachy added
Actions #4

Updated by Victor Julien 6 months ago

  • Related to Task #6463: eve/output: investigate how to track coverage / parity added
Actions #5

Updated by Juliana Fajardini Reichow 6 months ago

  • Subject changed from schema completion to schema: add missing fields
  • Description updated (diff)
  • Assignee changed from OISF Dev to Community Ticket
  • Target version changed from TBD to 8.0.0-beta1
Actions #6

Updated by Philippe Antoine 5 months ago

Actions #7

Updated by Juliana Fajardini Reichow 5 months ago

Actions #8

Updated by Juliana Fajardini Reichow 5 months ago

  • Related to Task #6597: rules keyword/output parity: improve added
Actions #9

Updated by Philippe Antoine 4 months ago

Another quick idea : use fuzz corpus turned into pcaps to get a big eve.json and then try jsonschema on it

Actions

Also available in: Atom PDF