Project

General

Profile

Actions
Copy link

Feature #8128

open

rules/transform: add json_decode transform

Added by Philippe Antoine about 2 months ago. Updated 15 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Like url_decode but for "\u003f", and also remove white spaces...

Files

backslash-u-json.pcap (1.15 KB) backslash-u-json.pcap Philippe Antoine, 12/08/2025 09:22 PM

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #8123: Suricon 2025 BrainstormAssignedVictor JulienActions
Actions
Copy link
 #1

Updated by Philippe Antoine about 2 months ago

  • Related to Task #8123: Suricon 2025 Brainstorm added
Actions
Copy link
 #2

Updated by Victor Julien about 1 month ago

  • Subject changed from Transform: json decode to rules/transform: add json_decode transform

Could be prototyped using Lua transform.

Actions
Copy link
 #3

Updated by Philippe Antoine 29 days ago

Pcap courtesy of Ron Bowes after his Suricon talk

Actions
Copy link
 #4

Updated by Victor Julien 15 days ago

Is the idea here to normalize/decode the JSON, but not parse it into a document tree? I remember from the discussion that there are also issues around key ordering.

Actions
Copy link
 #5

Updated by Philippe Antoine 15 days ago

For me this was about \u decoding + space removal, no key ordering

Actions
Copy link

Also available in: Atom PDF