Bug #7630: eve/alert: incorrect verdict with pass + alert rule - Suricata - Open Information Security Foundation

Actions

Copy link

Bug #7630

closed

eve/alert: incorrect verdict with pass + alert rule

Added by Jesse Lepich 8 months ago. Updated 20 days ago.

Status:

Closed

Priority:

Normal

Assignee:

Juliana Fajardini Reichow

Target version:

9.0.0-beta1

Affected Versions:

7.0.8

Effort:

Difficulty:

Label:

Description

This rule:

pass tls $HOME_NET any -> any any (alert; tls.sni; content:"checkip.amazonaws.com"; sid:202502272;)

produces an alert log entry with a verdict of "alert" instead of "pass":

"verdict": {"action": "alert"},

Subtasks 2 (0 open — 2 closed)

Actions

Copy link

Updated by Philippe Antoine 4 months ago

Status changed from New to Feedback
Assignee changed from OISF Dev to Juliana Fajardini Reichow

Hmmm... I would expect a verdict alert...

Actions

Copy link

Updated by Juliana Fajardini Reichow 4 months ago

Target version changed from TBD to 9.0.0-beta1

Actions

Copy link

Updated by Juliana Fajardini Reichow 4 months ago

It should be pass, if that's the rule that triggered.
The PASS action is the only one with a different check-style when we log the verdict, so there may be something here.

But more info could be of help, still, indeed.

Actions

Copy link

Updated by Juliana Fajardini Reichow 4 months ago

Label Needs backport, Needs backport to 7.0 added

Actions

Copy link

Updated by Juliana Fajardini Reichow 4 months ago

Related to Bug #7544: eve/alert: verdict reports "alert" when traffic is allowed implicitly/passively added

Actions

Copy link

Updated by OISF Ticketbot 2 months ago

Subtask #7906 added

Actions

Copy link

Updated by OISF Ticketbot 2 months ago

Label deleted (~~Needs backport to 7.0~~)

Actions

Copy link

Updated by Victor Julien 2 months ago

Label Needs backport to 8.0 added
Label deleted (~~Needs backport~~)

Actions

Copy link

Updated by OISF Ticketbot 2 months ago

Subtask #7911 added

Actions

Copy link

#10

Updated by OISF Ticketbot 2 months ago

Label deleted (~~Needs backport to 8.0~~)

Actions

Copy link

#11

Updated by Shivani Bhardwaj 27 days ago

Subject changed from pass rules with alert; keyword log with a verdict of "alert" instead of "pass" to output/alert: incorrect verdict with pass + alert rule

Actions

Copy link

#12

Updated by Shivani Bhardwaj 27 days ago

Related to deleted (Bug #7544: eve/alert: verdict reports "alert" when traffic is allowed implicitly/passively)

Actions

Copy link

#13

Updated by Shivani Bhardwaj 27 days ago

Has duplicate Bug #7544: eve/alert: verdict reports "alert" when traffic is allowed implicitly/passively added

Actions

Copy link

#14

Updated by Victor Julien 25 days ago

Subject changed from output/alert: incorrect verdict with pass + alert rule to eve/alert: incorrect verdict with pass + alert rule

Actions

Copy link

#15

Updated by Juliana Fajardini Reichow 25 days ago · Edited

Assignee changed from Juliana Fajardini Reichow to Philippe Antoine

As Philippe is working on a fix that seems to also impact this.

Actions

Copy link

#17

Updated by Juliana Fajardini Reichow 25 days ago

Has duplicate deleted (Bug #7544: eve/alert: verdict reports "alert" when traffic is allowed implicitly/passively)

Actions

Copy link

#18

Updated by Juliana Fajardini Reichow 25 days ago

Removed the Duplicate of #7544 as to me that one has more of a feature request + some considerations on what is understood as `pass` and `accepted` in IPS mode.

Although there may be more to that one -- which means it still requires further investigation, while this could be fixed by what Philippe has patched recently.

Actions

Copy link

#19