Project

General

Profile

Actions

Feature #6807

open

Support the use of variables within transforms

Added by Jeff Lucovsky 4 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

Support the use of variables within transforms, e.g,

alert http any any -> any any (msg:"byte extract test 1";  byte_extract:2,15,two1,string,dec; http.uri; content:"dGhpc2lzYXRlc3QK"; from_base64: offset two1; sid:1; rev:1;)

With this rule (and variable support from the from_base64 transform), the transform was never invoked following the call to DetectByteExtractDoMatch during content inspection.


Related issues 1 (1 open0 closed)

Follows Suricata - Feature #6487: transform: from_base64In ReviewJeff LucovskyActions
Actions #1

Updated by Jeff Lucovsky 4 months ago

Actions

Also available in: Atom PDF