Task #8131
openmodbus: add detection keywords to match logging values
Added by Philippe Antoine 9 months ago. Updated 14 days ago.
PA Updated by Philippe Antoine 9 months ago Actions #1
- Related to Task #8123: Suricon 2025 Brainstorm added
VJ Updated by Victor Julien 9 months ago Actions #2
- Related to Story #7901: 9.0.0: rules: improve rules keyword/output parity added
VJ Updated by Victor Julien 9 months ago Actions #3
- Tracker changed from Feature to Task
- Subject changed from modbus: ability to match on read value to modbus: add detection keywords to match logging values
As part of detect/log parity, add keywords for values we already log like reads.
PA Updated by Philippe Antoine 6 months ago Actions #4
- Status changed from New to Assigned
PA Updated by Philippe Antoine 15 days ago Actions #5
- Status changed from Assigned to Triaged
PA Updated by Philip Akekudaga 15 days ago ยท Edited Actions #6
I'd like to take this one. The idea: add modbus keywords for the fields already in the EVE log (unit_id, function, transaction_id, the access fields, etc.), the same way it was done for enip. I'll include userguide docs and suricata-verify tests. Contribution agreement is signed. Can you assign it to me?
PA Updated by Philippe Antoine 14 days ago Actions #7
Looks like I do not have the rights to assign this ticket to you for now.
But you can start corking on it ,thanks :-)
JF Updated by Juliana Fajardini Reichow 14 days ago 1Actions #8
- Assignee changed from OISF Dev to Philip Akekudaga
Ok, it's assigned to you now!
JF Updated by Juliana Fajardini Reichow 14 days ago Actions #9
- Status changed from Triaged to Assigned
PA Updated by Philip Akekudaga 14 days ago Actions #10
PRs are up: https://github.com/OISF/suricata/pull/15960 (keywords, docs, schema mappings) and https://github.com/OISF/suricata-verify/pull/3260 (tests).
JF Updated by Juliana Fajardini Reichow 14 days ago Actions #11
- Status changed from Assigned to In Review
- Target version changed from TBD to 9.0.0-beta1