Project

General

Profile

Actions
Copy link

Feature #8128

open

rules/transform: add json_decode transform

Added by Philippe Antoine 25 days ago. Updated 6 days ago.

Status:
New
Priority:
Normal
Assignee:
OISF Dev
Target version:
9.0.0-beta1
Effort:
Difficulty:
Label:

Description

Like url_decode but for "\u003f", and also remove white spaces...

Files

backslash-u-json.pcap (1.15 KB) backslash-u-json.pcap Philippe Antoine, 12/08/2025 09:22 PM

Related issues 1 (1 open — 0 closed)

Related to Suricata - Task #8123: Suricon 2025 BrainstormAssignedVictor JulienActions
Actions
Copy link
 #1

Updated by Philippe Antoine 25 days ago

  • Related to Task #8123: Suricon 2025 Brainstorm added
Actions
Copy link
 #2

Updated by Victor Julien 22 days ago

  • Subject changed from Transform: json decode to rules/transform: add json_decode transform

Could be prototyped using Lua transform.

Actions
Copy link
 #3

Updated by Philippe Antoine 6 days ago

Pcap courtesy of Ron Bowes after his Suricon talk

Actions
Copy link

Also available in: Atom PDF