Project

General

Profile

Actions
Copy link

Bug #7347

open

eve/alert: log file_data

Added by Eric Leblond 26 days ago. Updated 3 days ago.

Status:
In Review
Priority:
Normal
Assignee:
Eric Leblond
Target version:
TBD
Affected Versions:
Effort:
Difficulty:
Label:

Description

As transformation occurs on stream data when it becomes file data, it may not be trivial for the analyst to understand why an alert did fire on some file content. To address this problem, we can log the file data in the events to allow an easy analysis.

As file data is mostly binary, logging to base64 should be enough.

Actions
Copy link
 #1

Updated by Victor Julien 24 days ago

  • Subject changed from Log file_data in alert events to eve/alert: log file_data
Actions
Copy link
 #2

Updated by Philippe Antoine 3 days ago

  • Status changed from In Progress to In Review
Actions
Copy link
 #3

Updated by Philippe Antoine 3 days ago

Looks like a feature rather than a bug to me...

Actions
Copy link

Also available in: Atom PDF