Feature #6695: tls: log extensions - Suricata - Open Information Security Foundation

Custom queries

8.0.0 Stories
Good First Issues
OISF community
Open Doc tasks

Actions

Copy link

Feature #6695

closed

PA GT

Feature #2426: tls: extend logging

tls: log extensions

Feature #6695: tls: log extensions

Added by Philippe Antoine about 2 years ago. Updated 11 months ago.

Status:

Closed

Priority:

Normal

Assignee:

Gianni Tedesco

Target version:

8.0.0-rc1

Effort:

Difficulty:

Label:

Description

also for quic

cf discussions in https://github.com/OISF/suricata/pull/10135

Related issues 1 (0 open — 1 closed)

Related to Suricata - Bug #7685: tls: Invalid ja4 due to double client hello

Rejected

OISF Dev

Actions

Issue # Delay: days Cancel Multiple values allowed (comma separated).

History
Notes
Property changes

VJ Updated by Victor Julien almost 2 years ago Actions
Copy link
#1

Assignee changed from OISF Dev to Community Ticket
Target version changed from 8.0.0-beta1 to TBD

GT Updated by Gianni Tedesco over 1 year ago Actions
Copy link
#2

I would like to add to the TLS EVE output the following fields:
1. cipher suite list to client struct
2. cipher suite selected (to a new server struct?)
3. client extensions list to client struct
4. server extensions list to server struct (or in the root again?)
5. client supported signature algorithms in the client struct

My goal is to be able to reproduce the JA4 hash outside of suricata, but also to collect handshake parameters for eg. statistical analysis and survey purposes.. right now i am parsing them from ja3s, but it's not ideal.

Sascha also added "I agree, also unify the TLS parameter log output across tls and quic event types. Would be much cleaner -- atm one is in rust and one is in C, with different log schema."